Is there a way to confirm whether a samba AD was provisioned using RFC2307? Is it as simple as having the parameter "idmap_ldb:use rfc2307" in the [global] section of your smb.conf? -- Marco