We are actually looking into doing the same thing. Although we are probably going to add a custom attribute that we can set to the vlan of our choice, that way we can find the vlan by a simple ldap query without adding complex logic to the server. This to us seems the simplest route. It is worth noting that we do not have this in production yet so I cannot vouch for its real world effectiveness. As for getting the ldap query to work, you have already done the hard part. Once your server is able to auth users via ntlm the difficult part is over. We have setup a special account that has almost no privileges, only access to search AD. We use this account to interact with AD. If I remember correct deployingradius.com has an excellent walk through on the initial setup, I would try there for initial config instructions. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 From: freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.org] On Behalf Of Whitlow, Michael Sent: Friday, October 28, 2011 3:18 PM To: freeradius-users@lists.freeradius.org Subject: AD integration Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow