[Samba] Password expiry for samba & posix accounts in LDAP

[Plant, Dean]

Can someone install some confidence in me that the way I am dealing with
syncing password expiry dates between Samba and Posix accounts in LDAP
is correct.

The question has come up on the list a couple of times but the answer,
using "unix password sync = Yes" and changing the ShadowLastChange LDAP
attribute via an external script seems rather clunky. Is this really the
correct way to do it, when only allowing changing of passwords via
Windoze? or am I missing something obvious that enables this to be done
within the Samba/OpenLDAP configuration.

Thanks

Dean.