I've been successfully migrate my 3 site to samba (arround 400 users), all using manual work on ldap entries. Old sid and password hash are obtained using pwdump.exe. However, pwdump can not correctly obtain hash for machine account if machine was joined long time ago. I need to rejoin all clients and then run pwdump again, this way pwdump can retrieve machine hash correctly. My next site is having more than 500 clients in one site, so rejoining all client is not a good option. Anyone can confirm that net rpc vampire can obtain hashed for machine account correctly even if machine was joined 1-2 years back? btw, sid for machine account doesn't matter changed to another value, but hashes must having same value between client and server. Tks. --beast