I think this is worth pursuing. The question I have is whether supporting !username is sufficient. If we are going to support this kind of construct, it should probably mirror the existing query that contains uid, groups, gids and netgroups. Does that make sense? - todd