Well, two months later, I've discovered that this problem is solved by setting LDAP_OPT_REFERRALS off, for Active Directory 2003. Nigel Frost