And the reason posts have been slow today is... I got my Linux boxen to authenticate users with our Active Directory! YEEE-HA!!! No more "one account common to the whole herd," no more worrying about changing the keys on six different locks if someone who knows that account walks away, no more consultants getting the vapors over two different login structures. It's all-for-one now baby! I even managed to restrict it based on windows groups.
The vital clue? A software widget called SADMS, which appears to be a configuration shell for the disparate things you need to get Samba 3.x to register the machine to AD and use it authenticate users.