I am having issues getting the Radius password to accept anything but
the
NDS password. If I set the LPO to have a mandatory attribute of CHAP
it
fails the authentication, but putting it to NDS it seems to work???

In the Debug log you can see that it uses the NDS password no matter
what.