ok... maby i am just being slow....

but how does one create a "local" group on a AD Domain controller??

In nt4 all domain controllers shared the same local groups... It really seems like the "Domain local" is the AD incarnation of the NT4 DC local group...

Bryce