I know "net ads join" need a valid kerberos ticket, not sure what else. From my usage of samba 3.0 so far, it looks like most "net" subcommands need a valid ticket as well. Is it possible for them to use the secrets in secrets.tdb instead, except the join command? Chere