The way acs treats user request is to check it's local database first, then unknow user policy. Tht policy should say where to chek next. I your case it is an NT domain. The acs server must be a memeber server and a member of that domain. And the passowrds in the domain have to be stored in reversible encryption. and then what will happen is when a user request is recieved it will attempt to atheunticat agains the domain. Then if successful it will dup the user in to the default group as dynamically mapped. They will have a username but no password as that password is stored in the nt domain.
