Hi! We have an application, that does not honour the shadowExpire attribute. It does however use a search filter to find users. The idea is, that we would extend the search filter to include an additional attribute. We would then set this attribute to 0 or 1 and the filter would NOT return users that have it set to 0. Missing or set to 1 and the user gets returned. The search filters themselves do not provide any advanced comparisons like: if (shadowExpire =< today) then... Operation attributes seem to provide some more flexibility there. We could solve the problem if we could set up an operational attribute that would do if (shadowExpire =< today) then return 0 else return 1 Is it possible to add one's own operational attributes to 389DS? If it is, how should it be done the right way? Kind regards, Mitja -- Mitja Mihelič ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 8800, fax: +386 1 479 88 99