Hello all, I have FreeRadius v 2.1.10 installed and configured to authenticate users against Active Directory using PEAP/MSChapV2 and perform Group membership lookups via the ldap module so that I can configure radius reply attributes to provide VLAN assignment and Dymanic ACL's. All is working extremely well, but one item that I would also like to get working is the Machine Authentication. Machine Authentication is working with the exception of the ldap group lookup. From what I can tell, when the machine authenticates, the ntlm_auth knows that the request is a Machine Authentication and appends the $ to the end of the username for the sAMAccountName: # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [inner-eap] Request found, released from the list [inner-eap] EAP/mschapv2 [inner-eap] processing type mschapv2 [mschapv2] # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: host/lab.XXXX.com [mschap] Told to do MS-CHAPv2 for host/lab.XXXX.XXX with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=lab$ [mschap] mschap2: 78 [mschap] Creating challenge hash with username: host/lab.XXXX.XXX [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a9c34f78fae78fd0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=961d047adaedc84346d00fcd2a0a67139ff4a95c9e13ae61 Exec-Program output: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program-Wait: plaintext: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success Since I am using: filter = "(&(sAMAccountName=%{mschap:User-Name}))" in the ldap module, FreeRadius is trying to do a group lookup on: lab$ which is not found in any Active Directory groups: # Executing section post-auth from file /usr//etc/raddb/sites-enabled/default +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=XXXX,dc=XXXX,dc=XXX -> ou=XXXX,dc=XXXX,dc=XXX [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=lab$)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=XXXX,dc=XXXX,dc=XXX, with filter (&(sAMAccountName=lab$)) [ldap] object not found Is it possible to remove the "$" from the sAMAccountName in the LDAP module without breaking the User Authentication? Thanks Robert Graham