hi, thats my third question :). I run a samba 2.2.8a on SuSE 8.2 Box. I create a domain with ldap backend. On my W2K machines I need for programs in the domain rights for my user to access some software - like the internet conction button from microsoft on the desktop. I locked in lokal on my W2K boxes and put the "Domain Users" Group in my "Special Users group" In german: "Hauptbenutzer" from my samba domain. But the problem is, on one machine it works - the user locked in the domain and have the rights to click on the internet connction button, or start some apps and on other machines dose not work. the same user locked in on a other machine, and the rights dose not work, but there is the Domain Users group too. Yesterday I delete one of this machines from domain and create it new on domain. After this, I can put the Domain Users in the group "Hauptbenutzer" and all works fine. What is the problem ????? Is there a other way for my problem ???? Is it right, that all in Unix group "users" are mapped in samba "Domain Users" group???? Thanks a lot Axel