When I use wbinfo_group.pl it clearly can and does go and check if a given users is in the specified Active Directory group, which is good. The problem is that it returns "OK" to squid which squid does not seem to like. Here is the relevent line in squid.conf: external_acl_type nt_group ttl=5 protocol=2.5 concurrency=5 %LOGIN /usr/lib/squid/wbinfo_group.pl -d and here is what the logile shows: helperHandleRead: unexpected reply on channel -1 from nt_group #1 'OK' The question is this: What is Squid expecting as a reply for both a good match and also for a no match? If I can find that out I can change the script. Kind Regards Benedict White Tel: 01444 238070 Tech: 01444 238080 Fax: 01444 238099 Web: http://www.cse-ltd.co.uk Registered in England and Wales No: 3066242 27 Victoria Gardens, Burgess Hill, West Sussex, RH15 9NB