Jim, Thanks for your reply. The article begins to describe the issue, but in fact, applies to restricted sites in a destination set. The site they are "allowed" to view is doing this. It's happened exactly the same way with a number of different allowed sites, and they are all state or gov't institutions, so I know they are not hosting other domain content. We are using SP1, but just to see what the change in response is, I think I'll tinker with that registry key they specify. In any case, shouldn't the log show the S&C rule being applied? Why does it show a "-"? Thanks again. ~G!