Turns out that the samba response for a LSA_QUERYINFOPOLICY (info class = 5) sends the workgroup name unlike a Windows server (which sends the NETBIOS name). In fact, the client uses any old string that we pass here! I haven't been able to figure out why this behaviour is specific to groups though...