Well for those orgs that have a reason for strong security and are looking to or have deployed active directory, the Windows 2000 version have as a big security flaw.
If two administrators make changes to the same list, one set of changes is kicked out during replication as part of conflict resolution. This was a feature.
If a user x were deleted from a group by one admin, they could be returned to the group and retain group access rights and permissions due to the work of another administrator.
While that might not sound like a big deal to some smaller shops or larger ones that dont have tight security issues, there are many large companies, like defense contractors etc, that this could pose a big issue.
Originaly Microsoft said they were going to release a fix in service pack two, but rumor has it that after finding what it would take to do, they have fixed it with XP. If your already deployed, you HAVE to upgrade to XP on all your domain controlers to address this issue. Nothing like forcing you to upgrade to fix a major security hole in your product. Microsoft has kept very quite on this issue up to now but its been something many of us asked a long time ago and got the, hey I dont know, but we will get back with you.
After doing a search on Yahoo for Active Directory Bug, I came up with a couple of refferences:
( Oh and I love this quote: "Until the flaw is fixed, Microsoft says the workaround involves procedural policies for administering the directory." We all have to call each other, all 600 people who might administrate some portion of the tree to make sure no one else is going to do it? Perhaps, If your last name ends in a g you can update your... Enough.
http://www.infoworld.com/articles/hn/xml/01/02/27/010227hnactivedir.xml?p=br&s=5
So as you can see, many are going to be forced to wait for XP or at least have to upgrade again when XP hits the street.
Pet