Another relatively common question:
The ascontrol group page only allows creation/configuration of JMS and JDBC resources at the group level. Is it possible to create users across all the OC4J instances in Group from ascontrol?
Yes this can be done.
The solution is to use the Cluster MBean Browser provided in ascontrol and execute an operation on the J2EEApplication MBean via the desired J2EEServerGroup MBean.
Luckily its documented in the OC4J Security Guide, so I don't need to butcher the description any more!