Is this by chance on Win2000 Active Directory? I am working through the same issue and have tracked it down (as told by my AD guru) to our carrying SID history from our old NT4 domain. Have not yet tackled the script rewrite yet, still examining the possibilities.