Thanks Jakub,
I added as you suggested and can login! Thanks so much! Couldn't find this option in
man pages etc..what does this magic flag do exactly?
the primary group ( a mash of some large number with 513 on the end - Domain Users ) is
coming up numeric - would you recommend a local /etc/group entry to deal with this?
Unfortunately i only have TCP 389/636 access to the domain (firewalled environment) so I
can't use KRB5 though good to know - thankyou