[betski]

I haven't deployed HFA03 yet to keep in line with my test server but it's worth a shot. I've gone ahead rolling it out on the premise that our AD size will shrink by 10% next year when we migrate and then the NT groups should become usable.

I agree that from a security aspect there is no harm in unauthorised clients getting the policy but it does detract from the reporting and monitoring feature. Shame on you Check Point !!