Andrew, In my implementation, all my services are granted to all users. If a user's account is compromised when all services are compromised. This is irrespective of how the client's host name is defined or created. Because the TGC would allow entry to all services. Regards, Dom