Trouble with group checking against Samba4

[Arthur Ramsey]

I'm having trouble getting group membership to work against Samba4 
(Active Directory).  It doesn't appear to be running the search 
(&(objectClass=group)(member=%{control:Ldap-UserDn})).

I've googled and found others with the same issue, but I don't see the 
same configuration mistakes that they had made.

modules/ldap <http://pastebin.com/Bw5AUn89>
users <http://pastebin.com/H44gW7uT>
debug output <http://pastebin.com/YTFDTCy6>

-- 
Arthur Ramsey
Systems Administrator
Mediture
arthur_ramsey at mediture.com
952.400.0323

This e-mail and any attachments may contain CONFIDENTIAL information, including PROTECTED HEALTH INFORMATION. If you are not the intended recipient, any use or disclosure of this information is STRICTLY PROHIBITED; you are requested to delete this e-mail and any attachments, notify the sender immediately, and notify the Mediture Privacy Officer atprivacyofficer at mediture.com.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20131022/28020e20/attachment-0001.html>