> change SDs unter NT? One that can even handle the order > would be interesting. well if you're prepared to write a little code, it's possible in rpccleint. reggetsec command and regtestsec command. even lsaquerysecobject, or samquerysecobj but i don't havesets for those.