Hi All, This is more of an ntlm_auth how to than a FreeRADIUS question, but I thought I would post here since others may have run across this. We're trying to use ntlm_auth and FreeRADIUS to authenticate users against an ADS back-end. I've found several excellent articles on how to set this up, and I have it working with a single ADS domain. The problem I've encountered is performing authentication against multiple ADS domains using ntlm_auth. ADS Parent domain netidm.net ADS Child domain xyz.abc.com If I join to abc.com using net ads join, I can use ntlm_auth with no problems, but how do I perform authentications against xyz.abc.com ? I've tried: Ntlm_auth --request-nt-key --DOMAIN=XYZ --username=jdoe But I get an NT_STATUS_IO_TIMEOUT. I'm assuming this is because I'm joined to the Parent domain and not the child domain, but can't this work by only joining the one domain? # Samba Config workgroup = ABC server string = Samba Server security = ads load printers = yes log file = /usr/local/samba/var/log.%m max log size = 50 realm = ABC.COM wins server = 180.44.200.53 dns proxy = no comment = Home Directories browseable = no writable = yes comment = All Printers path = /usr/spool/samba browseable = no guest ok = no writable = no printable = yes #Kerberos Config default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log default_realm = ABC.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes ABC.COM = { kdc = 180.44.200.53:88 kdc = 180.44.200.54:88 } XYZ.ABC.COM = { kdc = 180.44.200.69:88 } .abc.com = ABC.COM abc.com = ABC.COM .xyz.abc.com = XYZ.ABC.COM xyz.abc.com = XYZ.ABC.COM profile = /var/kerberos/krb5kdc/kdc.conf pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } Any help greatly appreciated. Corey Corey Dow Network Solution's Test Center ProCurve Networking by HP