We have search yesterday many hours to find out wy our DNN-Installations >5 no AD-Groups synchronised.

The Effect is each AD-User can logged in via Integrated or Windows Authentication but not Roles-Membership is synchronised with the specified AD-Groups.

We find out that we must use in the Active-Directory Groups of Type "Security-Group Universal"

We change all neded Groups and all is synchronised to all DNN- Installations.

Its a Must-Info for the Active-Directory-Dotnetnuke-Documentation!

But where we can send this Info for the Documentation for a Extension?

We also experienced this same issue, and we do have a multi-domain setup. The odd part is that it appears the child domain groups do not need to be universal, it only seems to affect groups in the root domain. I also noticed that the entry in the log view for a new user in the parent domain is very brief (UserID, names, email, server), however for new users in child domains the log is pretty large but only has two fields, logdetail and server. The logdetail field for child domain users is populated with a bunch of xml containing the AD information. Not sure if that helps any, but I'm glad I found this thread - it seems to have solved our problem. Very nice job with the authentication provider overall, though, it may have it's quirks but the fact that we can have a group with the same name in three different subdomains and have them all auto-assign to the same role is great, thanks again for the work you guys put into this.