>Note sure about 0x1D; could it be the PAC verification RPC? Fairly >sure we saw it at domain logon. 0pcode 0x1D on the NETLOGON pipe is NetrLogonGetDomainInfo(). This is actually documented somewhere within the bowels of Microsoft's web site... -- Luke -- Luke Howard | lukehoward.com PADL Software | www.padl.com