In CA Service Desk Manager, there is an option in options manager called "ldap group enable". When this option is turned on, what the system does does is match an LDAP Group to an Access Type in CA Service Desk Manager. Thus, when importing users via pdm_ldap_import, or updating users via pdm_ldap_sync, it will give the user the access type that matches their group in LDAP. The key to this function is that the LDAP groups and access types much match exactly, at which point it will look at the users group, match it to the access type with the same exact name in CA Service Desk Manager, and give the contact that access type. IF the user's group(s) do not match an access type, it will blank out the access type field on the CA Service Desk Manager side when a sync/import is done.