User authentication in ADS 2003 with groups

Hi,

I'm configuring a portal with user authentication against a win2003 active directory. The users are placed in several ou's and the groups are placed in a separate OU.

Now, what I want did is: created a group (e.g. PortalUsers), placed all portal users in that group.

Since multiple OU's are used, a Deep Hierarchy is the normal way to go, but I prefer the Flat Hierarchy by pointing the User Path to the group with all the users and the Group Path to the OU with all the groups (CN's)

The LDAP check is successful, but none of the users in the group are able to logon.

Does anyone know if it's possible to authenticate users against ADS groups (CN) instead of OU's?

Much obliged

Marcel

(portal 6.0 SP2 P4 HF7 / win2003 / SQL2000)