Mike,

thanks for your work on this. It is working better now.  However, at one time when I synched, it would sync Security and Distribution groups. (i would like to do this because i don't want to created duplicate groups (although slight difference in name) to get the group to sync.  currently, only security groups sync.  Is there a way to fix this? Or should I change my approach?

Tom

TokenGroups is the best way to get security groups, including nested groups and the primary group, all in a single call. In the old days at least, getting distribution groups required recursing backward through the memberOf attribute. Not trivial. This is the kind of thing you might want to do after the rest of the login is completed. Or maybe do it as a scheduled once-a-day kind of thing at 3:00 AM. That would be sufficient for most things, I'd think. "You get partial access right now, but you don't get full access until tomorrow" would be okay for most of us, I imagine.

That said, this beta version fixed all of my problems. I now am huge strides further ahead of where I was on the weekend. Brilliant piece of work, Mike. I most certainly do appreciate it.

Someone else had the same error message (but at a different spot) with Server 2008 but I've never been able to get a copy to test with so I can't recreate/debug the error. However I just did some google searching on the error and one suggestion (though not a good one imho) is to use an administrator account in the impersonation. I don't know if you can use that account in the AppPool or if it has to be used in the web.config impersonation line. Can you give that a try and let me know if it fixes it?