The only caveat I could think of with this...
If you remove all groups from a user, that also includes "Domain Users" you may run into conflicts with your application set.
If you remove them from the group, then the point is moot.
BTW, did you know that you can achieve alot of this with the "query" functionality of AD Users and computers in XP? You can save the queries and export the data too.
Cheers!
Kent
