Here's the gist of what I've created (some might call it a monster)

Our environment had a number of domain admins (which we are now working
on pruning)  People would create users and not put in alot of the
information ("Too much work...") so I've created a front end app that
will:

a) create the user
b) create a home directory on a server of choice (based on which OU
they are in)
c) create a share for the home directory from that server.
d) create an exchange mailbox on a designated mailserver (based on OU)
and email address for the user.
e) place the user in a default group based on which OU they are in.
f) give the creator a list of other groups into which they have
permission to add the user. (This was the part that I needed this last
bit of help for)

This was all fine with DA's.  Then we created a "HelpDesks" group.
Suddenly things like D$ weren't available, remote WMI, Distributed COM,
reading the GC for email addresses, all fell apart.  The last few weeks
I have been rewriting the code to handle the lower privs.   When a
"HelpDesk" user creates a new user, they are now only presented with
the groups that they can "legally" add a user, not all :)

Now, like I said, my only problem is that my DA's get a list of about
500+ groups, and adding that process takes upwards of 60 seconds.

Here's what I'm doing for that:

ADNode = new System.DirectoryServices.DirectoryEntry("LDAP://" +
domainstr);
           System.DirectoryServices.DirectorySearcher ADSearch = new
System.DirectoryServices.DirectorySearcher(ADNode);
           ADSearch.CacheResults = true;
           ADSearch.PropertiesToLoad.Add("cn");

ADSearch.PropertiesToLoad.Add("allowedAttributesEffective");
           ADSearch.Filter = "(&(objectCategory=group)(!cn=domain
computers)(!cn=domain controllers))";
           GroupList.Sorted = true;
           foreach (System.DirectoryServices.SearchResult ADSearchres
in ADSearch.FindAll())
           {

//ActiveDs.ADSearchres.Properties["ntSecurityDescriptor"]
               if
(ADSearchres.Properties["allowedAttributesEffective"].Contains("member"))
               {
                   ADChild = ADSearchres.GetDirectoryEntry();
                   GroupListAddItem(ADChild);
                   if (ADChild.Name == "CN=G Env Env")
GroupListAddSelectedItems(ADChild);
               }
           }

Note, the calls to "functions" are delegates for background thread
update via invoke.  Am I doing something horribly wrong?