hi, you are using the Stripped-User-Name and/or the User-Name. however, the method you are attempting to use goes through the MSCHAP module...so you want to look at using mschap:User-Name attribute. or use unlang to regexp the domain. have you also got with_ntdomain_hack = yes ? alan