And if they are, what efect has with_ntdomain_hack=yes. Does it affect to all?? Well, Hi you all I hope haven't been too direct ;) I'll getting more troubles as I do more complex configurations. I ask this because first I had to authenticate users by machine authentication. The users in this case sends User-Name like host/username and the only way I found for working this out was to use ntdomain realm with "/" as the delimiter and enable with_ntdomain_hack. The other options stripes the User-Name but then packets doesn't match EAP-Identity ( at least one of them ), that is why I used ntdomain, for being able to use with_ntdomain_hack. Now I've got pda-users that sends domain\username and if I don't use ntdomain & with_ntdomain_hack it fails. So, that's why I ask if multiple ntdomains are allowed and how. Any method or idea will be welcome. Thanks