hi, on weekend I noticed that winbind got terminated (SIGTERM(15) ) without being restarted. So I wrote a script that notifies me when wbinfo -u returns with an error. So I figured out, that every time I disconnect from PPtP winbind stops. Today I raised the debug level and on connect it shows: [2012/04/25 08:22:30.409693, 3] winbindd/winbindd.c:1188(winbindd_addr_changed) winbindd: kernel (AF_NETLINK) dropped ip XXX.XXX.XXX.XXX (<- ppp0 adress) [2012/04/25 08:22:30.430632, 0] winbindd/winbindd.c:211(winbindd_sig_term_handler) Got sig[15] terminate (is_parent=1) [2012/04/25 08:22:32, 0] winbindd/winbindd.c:1336(main) winbindd version 3.6.4 started. Copyright Andrew Tridgell and the Samba Team 1992-2011 Why does winbind that? Winbind is bind to PPtP with ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1 --require-membership-of=S-1-5-21-3000185627-2527819853-479331972-1150" Greetings, Bj?rn PS: no, there is no script on /etc/network/ifup, /etc/network/ifdown nor in /etc/ppp/ifup or /etc/ppp/ifdown that refers to winbind