Do all users have a lastname in AD???
If not, that's a mandatory field and that's expected to happen if it's missing.
Check the LDAP logs and they will provide you more info of why it's failing.
HTH
java
If this helps, please rate
www.cisco.com/go/pdihelpdesk
HTH
java
if this helps, please rate