Help setting up machine auth with peap

[Josh Hiner]

Have a radius box setup and am using ntlm_auth to authenticate peapv0 
with mschapv2 in the inner tunnel off a samba pdc.

All normal users authenticate fine. When I try to authenticate using the 
machine account I get this:

eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Told to do MS-CHAPv2 for host/cc20000 with NT-Password
[mschap]     expand: --username=%{mschap:User-Name:-None} -> 
--username=cc20000$
[mschap] setting NT-Domain to same as machine name
[mschap]     expand: --domain=%{mschap:NT-Domain:-ISD} -> --domain=cc20000
[mschap]  mschap2: bc
[mschap]     expand: --challenge=%{mschap:Challenge:-00} -> 
--challenge=857e792244c9e024
[mschap]     expand: --nt-response=%{mschap:NT-Response:-00} -> 
--nt-response=0e44e0288f3f64004f58718f93e09c629670ab97d1e997bf
Exec-Program output: Must change password (0xc0000224)
Exec-Program-Wait: plaintext: Must change password (0xc0000224)
Exec-Program: returned: 1
[mschap] External script failed.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
Login incorrect: [host/cc20000] (from client CCISD-REMC-Radius port 0 
via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3
    MS-CHAP-Error = "\010E=691 R=1"
    EAP-Message = 0x04080004
    Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
    MS-CHAP-Error = "\010E=691 R=1"
    EAP-Message = 0x04080004
    Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 71 to 172.17.10.108 port 1033
    EAP-Message = 
0x010900261900170301001b34bc45f7fbc2e102f7ec6da756ce808f27d99f1074294fb3b5b69c
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xb410f68ebc19efa88b187555f468f0ff
Finished request 18.


I do see the "Exec-Program output: Must change password (0xc0000224)" 
which to me means the computer account password has expired? I tried 
removing and re-adding the computer to the domain but get the same error.

Any ideas? Anyone else successfully doing peapv0 auth with machine 
accounts and ntlm_auth?

Thanks for any help.