Afaik if groups are placed in OU's WinNT:// calls will fail. You'll have to specify the full LDAP path of the groupname or username/computername. You can get those path's with Howard's TranslateName Function in the UDF collection.