Hi, In modules/ldap, I have: ldap ldap_staff{ Queries the staff ou in AD } ldap ldap_student{ Queries the student ou in AD } In authorise section of inner tunnel virtual server I have: ldap_staff if (ok) { update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 141 } } else { ldap_student if (ok) { update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 142 } } else { reject } } All working OK and happily authorising any user who exists in Active Directory and instructs the NAS which vlan to put them into. Now I'm trying to authorise/authenticate users in a particular AD group for console access to the NAS (cisco switch) In default virtual server I have, after pap: $INCLUDE local/default_policy And in local/default_policy: if(!control:Auth-Type && request:NAS-Port-Type == Async && Ldap-Group == ADGROUP) { update control { Auth-Type = "ntlm_auth" } } ADGROUP is replaced with whichever group has the appropriate users If I don't have the Ldap-Group condition everything works except any valid username/password pair works. When I add the condition, radiusd -x shows rlm_ldap: performing search in ou=students, dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=user) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed First question - How do I tell rlm_ldap to query the staff ou without breaking the bit that is already working Second question - Is there any reason I shouldn't use the "$INCLUDE local/default_policy" construct. The idea is to make the policies easy to find as they get more complex; there are several more groups of users to go yet. Thanks in advance, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.