5 more minutes of testing, I tired
ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response} On a whim, and it worked (removed domain from ntlm_auth) Sorry for the excess question. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html