>I would say that someone who'll build that ISAPI tool to detect a password expired and prompt the user to update it, might be in good position to market this utility. Hey, might it be another challenge for you. :) It's not difficult to write this type of filter, however, it's relatively expensive in terms of processing load because any Auth filters get called on every request. Lot of throughput through the filter... I'm not a big fan of ISAPI filters (which is not the same as an ISAPI extension, BTW) for this reason. Also, filters are prone to crash the system if *anything* goes wrong in their code <s>... +++ Rick ---