Check the winbind log files,
Did that already. Nothing interesting there, only lines like [2012/03/08 14:32:17.115991, 3] winbindd/winbindd_misc.c:417(winbindd_priv_pipe_dir) [25675]: request location of privileged pipe [2012/03/08 14:32:17.117136, 6] winbindd/winbindd.c:840(winbind_client_request_read) closing socket 26, client exited
and perhaps try using "strace -f -p <freerad.pid> -o log" to watch process execution.
I already did that to get the command line. When I run that line manually I get "login failed". T try to figure out how to capture actual ntlm_auth output from within freerad process. Also, where freeradd gets the values for parameters MS-CHAP-Challenge = 0xd50bd065d4215da9 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000001e7c77d05691cb2822a6670bf0b458e251c4ef170a2c2fff ? Those seem to be wrong. When I use them manually from command line I get "login failed" A.