I am working in a mixed environment with a good mixture of 98,2000,xp, and Macs. I am trying to move to one group of people to authenticate to a win2k domain, and would like ISA to base rules on users and groups. My problem is if I try to get ISA to look at group membership by selecting the force authentication button, all internet connections have to authenticate. I want anyone who is not authenticating to remain working the same without having to type in usernames. Any help?