MCX problems !

Hi
Bit of a newbie question – have only recently started playing with OD/AD integration.
I have a small testbed using SL 10.6.8, Windows Server 2003 and a Mac Mini SL 10.6.8 client.
I’ve read all the docs I can and set up what appears to be a fully functioning magic triangle with AD authentication and OD management via WGM.
But – I’m having some issues.

Have worked through the Bombich doc and managed settings work in as much as I can apply a preference to an AD user within an OD group and when they log on to the Mac it takes effect.
The problems I have are with 2 of the statements in the doc:

2. Log out, then log back in as another AD user that is in an administrative group(according to the AD plugin configuration in Directory Utility). Because thisuser is an administrator, it gets an additional dialog upon login to opt-out ofWorkgroup Management.
> I don’t see this dialog. I’ve tried every which way and I can’t seem to allow AD domain admins to bypass managed preferences on the Mac client.

3. Log out, then log back in as another AD user that is not in any of the groups in your access list. You will be denied login because that user is not a member of the group that you created.
> I can log in with an AD userid that isn’t a member of the OD group I’ve created – it doesn’t get denied !

Any help much appreciated – I’ve been pulling my hair out over this !