The problem is not one of groupmembership, although I find the idea of mapping AD groups to certain citadel user levels attractive.
The scenario goes like this:
On a fresh AD install, you have the Administrator user which has the logonname "Adminstrator" (under Account tab). The other fields under the General tab, First name, Last name and Display name are empty. That is probably what you used for testing the AD connectability and it works fine in this case.
Now lets choose another user to become citadel admin, for some reason we choose is logonname to be "Postmaster", fill out his Display name as "Willie the One-Eyed Mailman", his First name as "Willie" and Last name as "Mailman". Now you would think the admin account name you provide to citadel setup is "Postmaster", but no, it would be "Willie the One-Eyed Mailman". So you remove the Display name from the user profile and think that you are now ready for "Postmaster", but no, now it is "Willie Mailman". Only if you leave the general tab completely empty you are finally able to have "Postmaster" as citadel adminstrator. (At least that's what I remember to be the case, didn't verify, since it is saturday evening. I can double check on monday.)
