Carl,

  I can explain #2 only:

When you turn on Synchronise Roles here is what happens (Mike correct me if I am wrong):

1. A user logs in.
2. DNN looks at what roles are avaliable in Security Roles and sees if that user belongs to any of those roles with the exact same name in your Active Directory.
3. If they do it automatically assigns that role to that user in DNN.
4. Also, If they did  belong to that AD group at one time but no longer do it  will remove them.

NOTE: This happens everytime a user logs in, so if you manually add a user to role only in DNN that they dont belong to in the AD it will take them out on their next login

If this is turned OFF it does not compare DNN security roles to the AD roles

Sorry for the lateness of the reply: I forgot to check "Email me for updates".

I've checked both the event viewer logs on the IIS machine, and the DNN event viewer, but nothing stands out.  DNN event viewer has only a single entry for the logon of a new user (IP: ..., WindowsAuthentication: True, Server Name: ...).  When I check the pre-configured DNN role, it is empty.

Given that there is no errors in the logs, I think my configuration must be incorrect.  Allow me to explain exactly what I have done.

I use Active Directory Explorer to check the AD details of my test user.  In the "memberOf" attribute, it lists the groups to which the user has access.  I have chosen one of these groups for testing.  To be precise (changing data here for privacy), the object is "CN=Joe Bloggs,OU=Contoso Users,DC=Contoso,DC=local" and one of the group values is "CN=Contoso Developers,OU=Contoso Users,DC=Contoso,DC=local".  In DNN, I have set up a role called "Contoso Developers", and have deleted the DNN user.

I now logon to the DNN site while logged on to my Joe Bloggs windows account (I'm doing this using a link on the page to .../DesktopModules/AuthenticationServices/ActiveDirectory/WindowsSignin.aspx).  DNN creates the user successfully.  I immediately logoff DNN and logon to my host account.  The role "Contoso Developers" remains empty.  If I manually add the Joe Bloggs DNN user to the group, it works.  And by the way, the Joe Bloggs user has a first name of jbloggs and a last name of CONTOSO (reflecting the windows username and domain).

Is my configuration correct?

Carl.