You might consider changing the account naming behavior for SAP Authentication so that it doesn’t create the [env]~[client]/[account_name], but rather the simple name [account_name]. That way the SAP account will alias to the WinAD automatically as long as the base account names match. The SAP roles may have to be re-imported, so be careful if you have set many users up already…you don’t want to accidentally delete accounts (that have no other alias) tied to roles you delete and re-import. Check out the following post:
bgray 
(BOB member since 2005-06-22)