I have to second Larry Cox's affirmation that the ENFORCELOGONUDC works. When turned on logon udcs are still intact for even SM users. If there is a bug Jeff, I can not find it. Just maybe?