Thanks for your replies.

Gazareth; there wasn't an error message - just that it wasn't possibly to browse AD domain users. I'm sure I used to be able to at some point (when I was working another job years go) - rather than trying to remember exactly what spelling a domain user name has, and then having to press Check Names to see if I got it right.

Derek, yes, that's probably one of the issues: SQL service runs under [localmachine]\Administrator, rather than under a domain account. Still a mystery why the SSMS dialog can Check Names, but can't browse the AD list of users and show them.

At the moment I'm too tired of cross-purposes to try to get the network admin to set up a domain user with minimal rights, for the SQL service to run under, just so that it can browse AD users.

thanks again!