Howdy!

I am using DNN 6.1.5 on Windows 2008 R2 server (IIS7.5). This is a new install on a new VM using Web Services Platform (with SQLExpress 2008).  I have downloaded and installed the AD authentication module (5.0.4).  I have followed the instructions to configure it (including the app pool settings, folder permissions, windowslogon.aspx, etc...). I am an old DNN warrior back in the 3.x and 4.x days.  But now I am trying to get back into the DNN world again.

Almost everything works,  AD logons are processed, accounts are created dynamically, etc..  My problem is with role synchronization (which I have enabled in the module settings).  I have three roles:

Domain Users

CE-S Web Site Staff

CE-S Web Site Faculty

I have created these three Security Roles within DNN - I have triple checked the names.  These are all Global Security Groups in AD (the Domain Users is the built-in group). I am using a test account that is a member of the first two groups (in essence a staff user), but not the third.  When I logon with the test account, the user account is created within DNN, but I am only put in the 'Domain Users' role.

Since I am put into the Domain Users role, I can rule out underlying connectivity and site\module settings.  But for the life of me I cannot understand the difference between the groups (other than one was built-in to Windows and the others were created by me).

I've looked through the forums and not found anything too helpful so far (the issues were not applicable to my situation for one reason or another).

Thanks in advance.

Yes. As a matter of fact, after it first failed, I cut and paste the name(s) from the pre-windows 2000 field into the DNN groups page just to make sure there wasn't anything funny that I was not seeing in the name.

I think I have fixed my situation. It appears to work correctly when I use the LDAP method of specifying the domain instead of the dc=domain method. I got it working by pointing the LDAP string to my specific AD domain controller (LDAP://server.domain.com).

I am not sure why this works.

I am in a large university setting. My department is a sub-domain from the forest root (the university itself is the forest root). This may be a clue.