Looks like you're expecting consistent grouping features in rules that aren't really there. Trying to use ANDs and ORs in the same rule will lead to unexpected results. They're designed to be used in separate rules ('x AND y AND z' or 'x OR y OR z,' but not 'x AND y OR z').
--Sandy
------------------------------------Sanford Whiteman, Chief TechnologistBroadleaf Systems, a division ofCypress Integrated Systems, Inc.
Defuse Dictionary Attacks: Turn Remote Mailboxes into Aliases on your IMail MX! http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/