Thanks for giving it a try Zack. I already replied to your previous post before I saw this one so I think you know what I need to do and what you can do in the meantime.

Hi I'm having a similar problem to Zack where the AD security groups and DNN Roles are not being sync'd properly. If I manually add a dnn user to a dnn role that matches the name of an AD group then they are stripped out of that group, whether their AD user account is a member of the AD group or not.

I've tried putting the identity impersonate line into the web.config and set permissions as per pg6 of the doco but still to no avail. Have checked that the account in the impersonate line can read the "member of" details for users and is all OK.

Have gotten it to work running IIS6 on WinXP, but now am trying to get running on Server 2003 R2, IIS6. Interestly without the Impersonate line in the web.config on the WinXP install the check after clicking "update settings" failed, however it says "OK" on the Server 2003.

TIA Andrew

On the WinXP IIS 'server' - DNN 04.08.04 & AD Provider 1.00.03 : which works fine.

On the 2003 R2 IIS Server - DNN 04.08.04 (Install) and AD provider version 1.00.03 have also tried the AD Provider 1.00.04.62474 : which I haven't been able to get to work. In short if the AD security group name matches the DNN role and the user had been (manually) added to the role then the user gets removed from the DNN role, regardless of wether they belong to the AD security group.

I'm guessing because it is removing the users from the matching groups/roles that it's finding them in AD but can't read the membership. Could you confirm that the account it uses is the one specified under the Admin\Authentication\Active Directory Settings or (if specified) the one in the identity impersonate line?