My analysis of the source code indicates that winbindd(the nsswitch related ones) is broken in 3.0 for 'non-trusted' domains. In other words, it cannot handle accounts of its own domain(be it a Samba PDC/BDC or in your case a member server of a domain).