On Mon, 11 May 2015, mourik jan heupink wrote: > I thought kinit is not required on samba-tool ldapcmp One can either kinit and use "-k 1" with ldapcmp, or use -Uadministrator instead. Without either, I get masses of differences (attributes that cannot be read). With either kinit or -U, I get exact equality for all three DC's. Steve