One clarification -- in my original message, I meant to say "posixAccount" in place of "inetOrgPerson". These are inetOrgPerson objects, but they also have the posixAccount objectClass which allows them to have the gidNumber attribute. -Kartik