We recently migrated from Sharepoint 2.0 to Sharepoint 3.0 and in the process we have discovered that we seem to be unable to completely hide the list of users for the entire site. This is essential because we use Sharepoint to allow us to create subsites for each of our patients, and of course they aren't supposed to be able to see the list of other patients. In 2.0 this was easy, we added the subsite users via the subsite and there was no way anyone could get to the complete list. In 3.0 a whole host of things seem to lead to the full list of users, including resetting a password, clicking on a link at the top of a form for customizing personal settings, etcetera. Is there hope? We tried creating a site profile that basically offered no access to the main site, but even that didn't work.