[j_ainsworth]

[QUOTE=malcolmx;1510358]if you can only find your user in the "long" tree but the search does not succed with the top level AD base, then it "could" be possivle that AD has a mechanism (like any other ldap) to deny a subtreee (scope) search.

All sorted!! If you want to query sub trees in Active Directory don't use the standard port number , use 3268 instead

Once I changed the port number I was able to change the filter to
$ldapFilter = "(sAMAccountName=" . $vbulletin->GPC['vb_login_username'] .")";

to login using the AD login name rather than the cn name

Cheers for all your help malc