Still running an older Freeradius version, I needed to add those two options to radiusd.conf. I'm also now pointing directly to an AD server - I found out today that other services depending on LDAP had to point away from the load balancer to get stability. I'll update once I let this run a while and prove either way. Tom King