>I can't find any attribute called 'tokenGroups' in my w2k3 dc It is a computed attribute, it must be explicitly requested (I think it may only be returned if the search scope is 'base'). -- Luke --