I've noticed in our Windows 2000 AD environment that anonymous logon has security rights to the user id's in AD (basically read rights to AD information). When any of the user id's are added to certain groups (not all groups) the anonymous logon security is removed from that id. Is there a setting or policy in AD that is taking away the anonymous logon rights when a user is added to a group?