We have ZDM 6.5 in the following single tree design on NW6.5 sp6: Top O
container that currently holds all users, zen user policies, and all
non-zen objects. Below this are several OU containers just one level
down from the O. One holds all non-user policies, one holds app objects
and one holds workstation objects.

We just added a new container just under the O to hold all users with a
particular project. I created a test user and discovered 2 problems.

1. When I would associate the test user to a zen user policy in the O
container, C1 would hang and mem use would go up to about 80 MB while
CPU use would hover at around 25%. If I closed C1 and then restarted it,
the zen association would show up for the user. I worked around it by
creating a new user policy in the new container, but I'd rather use the
policies in O if I can.
2. When I log in as the test user, no apps show up (with one exception
that I'll detail below). My search policy is associated with the O
container and the new container. I tried also associating to the apps
container, but that did not help (didn't really expect it to). Expected
apps are associated to the O container (users, not workstations).

The one exception was that I logged in to a different PC and got some
apps, but not all expected, AND some of the apps I got were in yet
another container at the same level that hold some apps that I'll
probably delete. Any idea what gives?

I guess if I have to add associations for all apps to the new container,
I can probably do it quickly by selecting multiple apps and making the
association, but I thought it would be inherited from O. I have checked
the effective read rights for the test user to the app objects, so no
problem there. Should I make an alias of the app container in the new
container, or put an INCLUDE statement in the new container login
script? I'm using include to run the O container script and that works
like a champ.

Apologies for trying to diagram in prose. Any tips are appreciated. Thanks.