Hi Folks, I was trying to get the group acl with regex to work and examining the code noticed that the group member values are compares as cis rather than dn as I would have thought given that group memebers are dns. Anyway I changed my version and it works. I wondered if the index of the uniquemember attribute could be used in evaluating the acl. Cheers, Gerrit Thomson.