You may have to go with impersonation Stuart. The original synchronization code (which was based on a lot of your 3.x sync code) had to be revamped because it wouldn't work with a Windows 2000 domain.

Edit: Oh, and how many AD groups/roles are we talking about here (including an average number of groups a user belongs to in the AD)

So it's just the Admin and Faculty that you're trying to pull across?

It's not so much the number of users in a role it's how many roles there are in the DNN site and how many groups (including parent groups) a user belongs to in the AD.

I'm going off of memory here but the role synch essentially works like this:

1. Arraylist populated with all DNN roles
2. Arraylist populated with all DNN roles user belongs to
3. Arraylist populated with all AD groups user belongs to (this is including any parent groups of groups they belong to)
4. #1 is compared against #3 to create an arraylist of matches.
5. #4 is compared against #2 to find out what roles the user should or shouldn't be a part of.

I'm not sure if upgrading to 5.1 will make a difference as the role synching code hasn't changed since AD 01.00.05 but if you can setup a test install somewhere it might be worth a shot (in case it's something else entirely that's causing the problem). Stefan Cullman has sent me some code that he thinks should streamline the role synching but I haven't had a chance to look at it yet.