Hmm... in 1.1.7, the "pap" module will take care of fixing NT-Passwords. i.e. map sambaNTPassword to NT-Password in ldap.attrmap, and list "pap" at the end of the "authorize" section. The pap module will see the 32-character hex string NT-Password, and convert it to 16-character binary format, which the rest of the server needs.

Wonderful!! That's obviously better...! :) Which encryption_scheme do I use? Stefan