James wrote: What does "do" mean? The original spec for dynamic groups was purely client-side, in which case any OpenLDAP server since the beginning would "do" them. The dyngroup.schema file was added in September 2003. If you didn't know that, you've likely been either living under a rock for the past few years, or using a Red Hat distro... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/