> > uint8 unknown2[84] is probably the replication schedule. yep, maybe I assumed something like this... thanks the problem is the unknown6[4] field (w2k) which is unknown6[6] in (w2k3) and because of that the blobsize is different. -- metze Stefan Metzmacher <metze at samba dot org>