I've tried all combinations of "if ingroup()" testing and only added the "<>0" after the first failure.

The script I'm currently using no longer has the ingroup() function. It was removed till I get this working. Therefore, posting the script would be of no value. Let's forget about the script I'm using. Even the most elementary test script, such as "? ingroup("administrators")", fails. Replacing "administrators" with any other local or global group gives the same result of zero every time.

I don't know the difference between a resource domain and a logon domain (I've programmed for 3 decades but only recently became an administrator). Our network is quite simple, consisting of 7 servers and about 100 workstations scattered around the country.

At the moment the only NT box I can test on is my experimental server, which is also a BDC. I test scripts both directly from the command line, as I do on the Win98 machine, and as logon scripts (tied directly to my own accounts to avoid upsetting others).

The resource kit apparently has a tool which allows one to determine which groups a user is in. I've seen it refered to but have not yet used it myself. This is something I'll be looking at next week.

I agree that if another tool can determine groups Kixtart should be able to as well. Then again, I can't explain why Kixtart isn't doing so for me.

One thing I may not have mentioned previously, the @primarygroup macro does work for me, so clearly the group information is getting to Kixtart. Unfortunately, I can't use @primarygroup to do what I want.