>Is there a means of creating/deleting groups/users and modifying file/directory access control lists (ACLs) in win2k programmatically, instead of RUNning AddUsers.exe and CACLS?

Active Directory Services Interface (ADSI). Search http://support.microsoft.com for VFP and ADSI, and you'll get a half dozen articles on how to manipulate Active Directory via COM.