We have a bunch of Macs that are authenticating against an OpenLDAP server. Some of these Macs break occasionally. It looks like, in the .plist, "Denied SASL Methods" changes from just DIGEST-MD5 to DIGEST-MD5, CRAM-MD5, NTLM, and GSSAPI. I'm wondering what could make that .plist (seemingly) spontaneously change, and/or how the "default" value could be changed so that our SASL method could be left alone.