just wanted to mention this one:
C1 1.36f (as in nw65sp6) has a nasty issue with adding members to a group
via the group object. instead of setting "equivalent to me" on the group
object it sends another modify on the user and sets "security equal to".
while the latter doesn't impose an issue as such (though in clean rings it
shouldn't be needed) the missing "equivalent to me" breaks referential
performing the task via the user object works as desired.
1.36e works ok both ways.
conclusion: if you've recently established group memberships via the group
object with C1 1.36f you should check those groups for consistency.

someone might want to log a defect.