well, one would think that the next test would be to have the user that everything works log onto the same computer and run the same report and see what happens.

I am assuming that both run the report exactly the same, ie all parameters are exactly the same.

CR, at least in my experience, doesn't really know anything about the user, nor seems to care. If data is to be restricted, it is usually via some other mechanism...the ODBC connection connects with a user who has fewer rights or the report has something it that takes the user info (like a runby parameter) that will then throttle the data. Other than that type of scenario, CR will return all the data...the designers logic being, if you can run the report, you can see the data.

HTH