Just an FYI with my current setup now....If I leave syncronize roles on, as users login they are actually removed from their roles that are in AD and the portal, since I've rolled back to version 1.00.03 from the beta 1.00.04. You said that there wasn't a difference in the way roles are sync'd between the two, but then why would this happen?
I used three different account to test with. If I manually add the user to my custom role that matches their group membership in AD, then log them in, the user is removed from the group on the portal. If I manually add them back to the role, and uncheck "syncronize roles" they are fine. Is there a way to completely remove the AD provider and start over? I've got new users joining all the time (intranet application) that I don't want to have to be bothered with adding them to the correct roles. The sync roles was working very well, with the few noted exceptions herein, but now it does just the opposite of what I need it to do! Sorry to bug you.