I think I read somewhere that 'ldap machine suffix' is used only if winbindd is used as well. Peter -- Peter Rindfuss Wissenschaftszentrum Berlin fuer Sozialforschung (Social Science Research Center Berlin, Germany) email: rindfuss at wz-berlin.de phone: +49-30-25491-566 fax: +49-30-25491-558