Ah, Writing this email I found the words… and found that people use multiple -r options. I was already too deep in to notice -- sorry. Still, this isn't dynamically configurable… is it the only way to do it? And will kadmin / kpasswd work? Thanks again, -Rick