Well... I am so used to pulling stuff from AD using LDAP queries that I usually have the DN in hand anyway. There are so many things that LDAP can do that WinNT cannot even if this is not one of them.