Full_Name: Howard Chu Version: 2.4.39 OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (78.155.233.73) Submitted by: hyc It looks like autogroup runs all its internal modifications using the same identity as the original op that triggered it. It should be using the rootDN, since the original user may not have permissions to search or modify all of the affected entries.