itdaddy, this is correct. Only change the LDAP string to what it really is. I've tested this on 3 domains now and it works fine.