Sorry, I just c/p that line from other link
here is mineexec ntlm_auth_pap {shell_excape = yes
wait = yes
input_pairs = request
output = none
program = "/usr/bin/ntlm_auth --request-nt-key --domain=EXCHANGE --username=%{mschap:User-Name} --password=%{User-Password}"
}
should domain field be pre-windows 2000/NT name or fqdn? (domain.com)