The default setting for this is 'no', which means 'Update the NT and LM passwords in LDAP, and update the last set time'. This *will* cause a lot of grief if you are trying to use another mechanism to set the password, such as a custom script. It can also be set to 'only' which means it will only update the LDAP password (which is the userPassword field, ie the password that unix services will use via pam_ldap). Setting it to 'yes' means it will attempt to update all three passwords and update the last set time. This is almost definitely what you want. 

  

 !IdealX Samba Administration Scripts 

  

  

 The smbldap-populate script will add in the "basic" builtin users and groups you need for decent windows interop. 

  

 The other scripts can be specified in smb.conf for things like adding users, adding machines (essential for joining a Windows client to a Samba domain run from LDAP), and so on.