Who am I to say this? I am only a lowly user and would-be admin, but it seems to me that one of the most useful features of an AD environment, GPOs, is not fully trust-able under Samba because of instability and ensuing fear, before and after each update, related to sysvol and who knows what. I still love you, though.