I'm not even sure this is the path I ought to be going down. If smbk5pwd has no knowledge of ppolicy, and password changes from Windows clients won't adhere to those restrictions with any combination of configuration options in any currently known universe, perhaps what I really need is an alternate strategy. I'm open to suggestion; my only requirements are that password changes from a Windows workstation be subjected to the ppolicy constraints, and that the LDAP and Samba passwords all be in sync. rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}tFEA391Y3ZLHXkQDDk6f0t1ZkJEuMwIj
Are you still using the rootdn as the Samba bind DN? If so, don't.