> Turns out I made a dumb mistake. I did a kinit before ldapcmp, but > omitted the "-k 1" on the latter. When I do it correctly, all three DC's > are exactly the same. Phew. I thought kinit is not required on samba-tool ldapcmp I just tried _with_ kinit, and only saw the same differences on whenChanged. MJ