Does a filter like (!(cn=bob)) match an entry which does not contain any cn values? Or maybe more precisely, does the filter (cn=bob) evaluate to FALSE or UNDEFINED for an entry with no cn value? John McMeeking