I got this working - Thanks for all the useful posts in this forum. now the problem is that when a user logs off of the windows machine, we still want to be able to manage the system so we need to put a certificate on the machine store (not just the user store, personally I don't like how windows does this, it should give you a choice of what cert to use but anyways..) When the system attempts authenticating with machine cert, the username it presents the radius is host/user@domain.dom and I need radius to strip out the "host/" in all requests if it sees one. How do I do that. I know how to do this with hints file but I can only add stuff onto the username how do I trip?? Thanks, ____________________________________________________________________________________ Looking for earth-friendly autos? Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center. http://autos.yahoo.com/green_center/