I have looked in past posts and I think my question is answered, but since we are dumping websense and going with Squid (based on what we think we already know), I wanted to be sure. We use websense now, but because 80% of our users are citrix users, we have had to implement an isa server that redirects requests from our firewall (pix) back to the isa (for Integrated AD authenication). This is because an admin user would be logged into the terminal of the citrix server, and that is the credential that was getting passed to the websense server = many suprised surfers!! I have always heard great things about Squid, and websense is just a huge pain and VERY expensive. I am just worried that we are going to have the same problem. But I think I read that Squid will use the authentication from the browser's header, and not from who is authenticated to the box or ip. Anybody got any good examples of using Squid to authenticate to AD (Samba has to be somewhere on the network.. right.. can't just be all windows) and REALLY do per user coming from a Citrix farm? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com