My only thought for the above is that when run as a CGI, it's running as the IIS user windows account (but when you try from cmdline you're using your windows account), which for some reason doesn't have permission to create or use the LDAP OLE object. What is the value of Win32::OLE->LastError()?