I've got <mssql.conf> read_groups = yes but the rlm_sql module does not process the groups. The user is found in radcheck and the check items (password) does match... and I do NOT have "Fall-Through" = yes in the radreply ... as per docs... (3d) 3. Group processing then begins if any of the following conditions are met: a. The user IS NOT found in radcheck b. The user IS found in radcheck, but the check items don't match c. The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table d. The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes' Am I doing something wrong here? If I have Fall-Through = yes then everything works as per docs (3c) But 3d does not say that Fall-Through has to be yes Alan?