I've been making a note of all the symptoms I'm seeing. What I don't know is the diagnosis.

1) To make any changes on the Admin-->Authentication page, I must turn impersonation off. If I don't, the global catalog is not found.
2) To authenticate users, I must subsequently turn anonymous impersonation back on.
3) Supplying a valid username and password to impersonate causes windowssignin to hang.
4) When a user authenticates, most distribution groups synchronize. No security groups sync.

Those are the symptoms, here are the specifications:

1) In the AD snap-in, all security groups are of type: Security Group - Local Domain.
2) All corresponding security groups in DNN are using the pre-2000 nomenclature.
3) I am running DNN 4.8.3 on Windows 2003 Server using IIS6 and dot net 2. All service packs installed.
4) I am using the 01.00.04.36979 build of the provider. I encountered the same problems with previous builds.
5) There are seven domains in the forest.
6) I'm only trying to sync to one of the domains, but the other six would be okay to get.

Getting a little frustrated after a couple of weeks of getting nowhere fast. Thanks for anything that points me in the right direction.

Tom when using impersonation in your web.config does it look like this (note which lines are commented out)?

For #4 are you sure it's not security groups that are synching and not distribution groups? Everything I've read on getting groups and in my own testing shows that distribution groups are not synched while security groups are synched (when using tokenGroups to get the groups a user belongs to).

As I think I've mentioned before, I don't have a Forest to test against and for that I apologize but I do know of users that have gotten it working on forests with the exception of some synching problems (the common problem is that synching only worked for the domain that was set in the settings and not for the other domains available).

Here is the exact sequence of steps I have to follow to modify my authentication settings:
1) Log in with anonymous impersonation uncommented.
2) Go into web.config on the server and comment out impersonation.
3) Make whatever changes I want on the admin-->authentication page.
4) Uncomment anonymous impersonation in web.config again.
5) Log out and log in to test the changes. Return to step 2 as needed.

This is the only thing that works, these exact steps. Any deviation from this fails. Valid credentials on the impersonation line makes it behave identically to when impersonation is commented out completely. DNN treats them as being exactly the same. If you go through the steps above, wherever I say I comment out impersonation, you can also replace that with "add valid credentials to impersonation" and it behaves exactly the same. Valid credentials does the exact same thing as commenting out the line. They are interchangeable. Very weird.