OS: Debian Woody Samba: 3.0.4 I am seeing the following lines show up over 6713 times over the course of a day in the log: [2006/10/05 16:05:55, 2, pid=7233, effective(65534, 65534), real(65534, 0)] auth/auth.c:check_ntlm_password(305) check_ntlm_password: authentication for user [GEER] -> [GEER] -> [geer] succeeded This user also cannot access the internet when the fileserver is down. This leads me to believe that the user is being authenticated through the fileserver everytime the user tries to access the internet. Any ideas on what would be causing this? Thanks, Tom