One problem lots of folks tend to run into, is that they type a trivial password into the NAS config wizard. When they attempt to create the Windows service principal (via the ktpass command on windows), they get a "password does not match" composition rules for the windows environment. At this point, you have to use a password that meets the windows rules -- but most importantly, you also have to go back and change the password in the keytab file on i5/OS to match whatever new password you provided on the ktpass command in windows.This is a great point, Patrick. Is there an easy way to "test" a password for composition rules? ktpass is not exactly the most intuitive tool, at least for me.