(the PDC and is therefore "logging into the domain") or at the local system level. If you want the PDC to validate the user, he/she will be, by definition, "logging into the domain". You can turn roaming profiles off, which is what I suspect you may be looking to do. However, you cannot, using Samba 2.x, do it on a user by user basis - it is done for all users or no users. Possibly Samba 2.x's biggest weakness.