Stuart, thanks so much for this.  This is going to help me so much on my intranet.  But I have a question.  If I want to assign someone to be a DotNetNuke administrator it will automatically remove that user from the Administrator group.  And also it doesn't seem to be assigning them to the groups from AD.  I've created a role in DNN and I'm assigned to a group with the same name in AD but it isn't assigning me.  It was working with the old code, but when I put your code in it isn't working.

I'm using patch v 3.5.5 that was d/l off of your website on Oct. 24.  I assume the latest & greatest.

I'm running DNN v 3.3.5.

It worked before (running the core version for clarification) where it would auto-add rolls, but was not designed to auto-remove rolls (but a very important feature IMHO).

I have a AD group called "Lot Database Users" and a DNN Roll called the same.  The DNN roll is not "Public" but I'm not sure what the difference is.

And I just verified this.  I logged in as host and added my account to the Administrators roll.  I logged off and went to the /admin/security/windowssignin.aspx page and I was not an admin and was not in the Lot Database Users roll.

ksbecker.... the latest does add to the roles. A couple of things that I experienced though:

1.  On the system I was checking to verify that my non-admin account was being added to the roles: It didn't work right away when I was logging off and on along with the admin account. I suspect it may be a cookie issue but if I left it for 10 or 15 minutes it started working properly. I was the only one that had this issue where anyone who hit the site from another computer had no problems.
2. Make sure you use the Pre-Windows 2000 group name as your DNN role name. I couldn't figure out why no accounts were getting added to the Business Staff group until I looked at the properties for the group in the AD and saw that the pre-windows 2000 group name was Busstaff. Changed the DNN role name to that and accounts started to get added.

I haven't worked on a workaround for the administrator problem you've run into yet. We've got the same problem but have decided that we can switch it manually until there's some time to devote to it.