Then why don't you define it in the eu_ldap configuration (see "Assign all imported users to these BE groups")? I think this option hasn't always been there but it is there in your version of eu_ldap. Or are you saying that it doesn't work for you or that you are trying to achieve something else? Tomas Mrozek