i found a workaround that involves a small modification to the ADSIProver source. this example only filters out the built-in Administrators AD security group from the security groups to be synced with DNN security roles. it could easily be modified to filter out a list of built-in AD security groups. i've only done a little testing with this so far so proceed at your own risk. hope you find it useful.

1. Open the \\src\Providers\AuthenticationProviders\ADSIProvider\Provider.Authentication.ADSI.vbproj project file.
2. Go to the GetGroups() method. Find this block of code:

' Populate member with distingushed name
PopulateMembership(group, entry)

colGroup.Add(group)


3. Replace with this code block:

' Prevent built-in Administrators Security Group in AD from being
' automatically assigned as Administrators security role
' in DNN.
' -- START Modification --
If objRole.RoleName <> "Administrators" Then
' Populate member with distingushed name
PopulateMembership(group, entry)

colGroup.Add(group)
End If

' -- END Modification –

4. Build the DotNetNuke.Authentication.ADSIProvider.dll (don’t forget to be in ‘Release’ Mode!)

5. Backup the DotNetNuke.Authentication.ADSIProvider.dll in the \[dnn root]\bin\ folder and copy the newly built DotNetNuke.Authentication.ADSIProvider.dll into the directory

Hi Kevin, any chance of sending that modified dll you created to me again?  I'm pleading technical difficulties over stupidity which ended up with it being poofed.  markguer 'at' optonline dot net

Thanks if you still watching this board.

--Mark