Authentication

I think that you may have answered your own question. A global catalog server in each seperate office is the way to go. It will also provide with some fault tolerance, if the server goes down at corp, ALL users will not be able to log on. Microsoft recommends at least one GC per remote site, that doesn't mean you can't have more than one. One thing that comes to mind is, if you are running in mixed mode can't you just add a BDC at each site. There is also a Q article you can look at if youwish, but I would use it as a last resort. The Q article number is Q241789. Let me know which of these solutions you are going with as I am am intereseted.

Good Luck

Norm

So, the users in the USA authenticate to DCs all over the USA, instead of their local DC? And the entire USA is in its own Site?
That is why.
Workstations authenticate to any DC in the Site they belong to. If every single workstation in the USA isin the USA site, than users in PTA might authenticate to the SA DC. It is the Site boundaries that limit authentication.
So, change the IP policy to have each USA office as its own Site. It is a small change, but it will fix your problem.

Here is a URL to a Microsoft white paper on Sites:
http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/adsites.asp
(please remove any spaces)

hope this helps