hi, quick hack/fix would be to either 1) set 'prefix' to be } with this, anything before and including } (which may never appear as a realm or username) would be treated like a NT domain and be stripped off logically 2) use attr_rewrite or unlang to remove the {blah blah} stuff and set the output value as Stripped-User-Name (safe!) alan