I have been trying to create some rules that would pass users through
the Surfcontrol filters before going to the web. The long and the
short of it is that I can pull these rules off if I base the users on
IP address, but if I try to do it through NDS, it finds the users and
allows me to select them, but the rules aren't applied (they can go
right through the filters). This is also the case with just blindly
allowing and disallowing users (without bothering with the surfcontrol
filters at all).

Is there a reason I'm not able to create rules that successfully
reference NDS? I am currently on BM 3.8 sp3. I understood that I
shouldn't go to sp4, but would do so if it is likely to fix this

Thanks in advance for any and all help!