Nesting of local groups (SID_NAME_ALIAS)

Stefan Metzmacher metze at
Thu Mar 16 19:34:15 UTC 2023

Hi Pavel,

> windbind does not correctly display members for e.g. BUILTIN/users. It shows nothing:
> ./bin/wbinfo --group-info BUILTIN/users
> BUILTIN/users:x:100001:

This is good as default and should remain being the default,
as "winbind expand groups = 0" is the default.

Maybe "winbind nested groups = yes" is also relevant here, but I'm not sure.

> Given that "BUILTIN\Users" has 1 member "ADDOMAIN\Domain Users", it should instead show:
> ./bin/wbinfo --group-info "ADDOMAIN/domain users"
> ADDOMAIN/domain users:x:100006:ADDOMAIN/joe,ADDOMAIN/jane,ADDOMAIN/samba2008r2$,ADDOMAIN/samba2003$,ADDOMAIN/administrator,ADDOMAIN/krbtgt,ADDOMAIN/testallowed 
> account,ADDOMAIN/testupnspn,ADDOMAIN/testdenied,ADDOMAIN/alice,ADDOMAIN/srv_account,ADDOMAIN/bob

Is this really required? in a huge domain this will likely never finish. and it's also imposible to get right,
as members might be located in a different domain/forest.

So I'm not sure how useful this is.

> I am working on the fix. One part is to call dcerpc_samr_GetMembersInAlias() instead of the wrong dcerpc_samr_GetAliasMembership() in source3/winbindd/winbindd_rpc.c.
> Another part is to change the code dealing with nested groups / aliases. For that, I need to understand if aliases (SID_NAME_ALIAS) can be nested, like groups 
> Reading the Microsoft documentation
> /A local group can contain user accounts that are local to the computer and user accounts and global groups from their own domain./
> It looks that "Local groups" which I believe is BUILTIN/users (SID_NAME_ALIAS) cannot contain another "Local group". I have tested that also on Windows server using 
> lusrmgr.msc and such nesting was not possible.
> However, samba server allows such nesting:
> bin/net sam createlocalgroup TestGroup1
> bin/net sam createlocalgroup TestGroup2
> bin/net sam addmem TestGroup1 TestGroup2
> Can I assume that SID_NAME_ALIAS cannot be nested?
> Best regards,
> Pavel

More information about the samba-technical mailing list