> At this point probably single stepping through the code in the > debugger > is the best/quickest route to figure out what's wrong. UTSL and all > that... I feared you might say that ... but, for amusement, I tried changing passwords using ldapmodify and strangely, the subtree pwd policy *is* enforced but if I do exactly the same pwd mod with ldappasswd, it isn't enforced. Given that the pw policy is all done on the server side, any ideas how on earth I could be seeing this?