[Samba] Active Directory group membership changes not reflected in winbind information

[Markert, Martin]

Hi,
I’ve added an existing group („2d3d“) to an existing user („jschopp“) on our AD server. When I execute „id jschopp“ the new group membership is not reflected:

# id jschopp
uid=1333(jschopp) gid=2020(domänen-benutzer) groups=2020(domänen-benutzer),610(BUILTIN+users)

This is a strange behavior. Is this a caching issue?

Kind regards,
Martin

AD: Windows Server 2008 RC2 with Windows Services for UNIX
AD member: CentOS 6.6, sernet-samba-4.1.14-9

This is my Samba/Winbind configuration:

[global]

        workgroup = ARRI
        server string = Samba Server Version %v
        netbios name = BARBARELLA

        # logs split per machine
        log file = /var/log/samba/%m.log
        # max 50KB per log file, then rotate
        max log size = 50
        log level = 3

        security = ads
        realm = ARRI.DE
        encrypt passwords = Yes

        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind nested groups = Yes
        winbind separator = +
        winbind offline logon = false
;       winbind nss info = template rfc2307
;       idmap config ARRI:backend = rid
;       idmap config ARRI:range = 10000-99999
        idmap config * : backend = tdb
        idmap config * : range = 600-799
        idmap config ARRI:backend = ad
        idmap config ARRI:range = 800-19999
        idmap config ARRI:schema_mode = rfc2307
;       idmap config *:range = 16777216-33554431
;       idmap uid = 600-20000
;       idmap gid = 600-20000

        allow trusted domains = Yes
        server signing = mandatory
        client signing = mandatory
        client use spnego = Yes
        ntlm auth = Yes
        lanman auth = No

# --- Kerberos ---
;       kdc:service ticket lifetime = 24
;       kdc:user ticket lifetime = 24
;       kdc:renewal lifetime = 120

… shares following



Martin Markert
Systems Integrator
 

Tuerkenstr. 89, 80799 München / Germany
Phone +49 89 3809-1848

EMail MMarkert at arri.de

  Visit us on Facebook!________________________________
 [http://www.arricommercial.de/wp-content/uploads/2015/04/2015-04-16a-E-mail-Signatur_ARRI_Media.jpg] <http://www.arri.de/filmtv>

Get all the latest information from www.arri.de/filmtv<http://www.arri.de/filmtv>, Facebook<https://www.facebook.com/pages/ARRI-Film-TV/117731121606986?fref=ts>

ARRI Media GmbH
Sitz: München - Registergericht: Amtsgericht München
Handelsregisternummer: HRB 69396
Geschäftsführer: Franz Kraus; Dr. Jörg Pohlman; Josef Reidinger