Les I've only got 140 users so i'm under the limit. I've made a failed user a Domainm admin and the script runs fine. @primarygroup can be defined only when an NT4 upgraded user is a Domain Admin. So a possible solution could be to make Everone a Domain Admin [Eek!]

Howard,
I will try to run your EnumObject again when I am back at the office in about an hour