Sorry! (Let me get my head out of the sand) I use a check script called ldap.monitor. It comes with mon, a monitoring package written in perl. The script just binds and checks that a certain attribute exists and is a certain value. Here is an example: monitor ldap.monitor \ --username "uid=mscript,ou=Special Users,dc=hq,dc=org" \ --password "12345678" \ --basedn "uid=mscript,ou=Special Users,dc=hq,dc=org" \ --filter "uid=*" \ --attribute "uid" \ --value "mscript" \ 192.168.16.10 I use this on BOTH of my servers. The other day I attempted to delete alot of objects (>10,000) as the admin user from my ou=people leaf and then my admin account was locked out with this SAME error. Then my script started failing. I ended up having to login as Directory Manager to complete the deletion. So my script now fails and neither my admin account (admin) nor my script account(mscript) can login successfully. The log entries are the same: "RESULT err=3 tag=101 nentries=0 etime=0" All that is happening is that the script is checking to see if an attribute is the right value. The script cant login and therefore fails the *check*. I have restarted the server several times. Thanks for your time, Dave On Thu, 2006-12-14 at 23:54 +0100, Pierangelo Masarati wrote:

Thanks, I added an attribute, "nstimelimit=-1" to the user, mscript and all is well. However, I did it from another server that it is setup with in a MM configuration. The replication occurred and the lockout stopped. Some background: This script does checks every 30 seconds. Having this occur so often is necessary because this DS is behind a load balancer and the results of the script update the load balancer with it status. If the script fails, the server is taken out of the load balancer. Another Question: This got me to think about applying this attribute at the OU level, instead of on each UID. Will that apply to ALL users in that OU ? Thanks, Dave