Exactly. Don't need the machine trust account overhead, Workgroup resources are fine, but need login scripts so that I can dynamically map shares. Preferably ask the user for his u/p then go attach to samba, run a central login script, then run a user or group script if available.