Hmmm.<br><br>Don&#39;t update user-name. Set or update stripped-user-name instead and use that in the mschap auth<br><br>actually I&#39;m sure by default the system understands these user names so as long as you use %{mschap:user-name} you&#39;ll be using the correct value in that place.... we do machine auth to multiple AD backends with none of this hassle....which is why we use FR.<br><br>alan<br><br>