This reply is very late but I have just recently come across this problem myself. I hope my answer might still help others with a similar problem: For AD (Active Directory) authentication to work with groups in the AD it is important that the AD "Domain Functional Level" is set to "Windows 2000 native" or "2003 mode" (and not the NT4 compatible "mixed mode"). If the AD is left in mixed mode then logins will work but the groups the user belongs to can not be properly read by EPiServer. Only machine local groups like Administrators and Users will work, but AD groups will fail. You can upgrade the mode (it can not be reversed though, so make sure you do not have any old NT4 servers or other units that require mixed mode) in the "Active Directory Users and Computers tool" by right clicking the tree name and selecting "Raise Domain Functional Level" in Win2003 or something similar (a button called "Change Domain Mode" instead of a menu option) if you use W2k server. All group types work fine i.e. both domain local, global and universal groups are interpreted by the AD. Any group you wish to use must be specified by name in the group administration dialogue inside EPiServer. How to do this is described in the technote "Security in EPiServer.pdf". In short you just add a group with a name on the format "DOMAIN\Groupname". The change in the AD can take a very long time to activate in EPiServer because login information is being cached by the EPiServer system. To ensure a quick response, log out, log in again and then run "iisreset" on the webserver. There should be a better less interruptive way to do this but I have not found out how yet. Without this procedure you might have to wait for 30 minutes for the AD information to be updated. You do not have to, in fact you should not, specify any LDAP parameters at all! Just leave all these blank since they are only needed for LDAP authentication, not for pure AD authentication. Hope this helps! Best regards, Mats B.

Hi. Thanks, Mats. We do not have this problem any longer, but this is good information. Keep up the good work! Frank :)