[Samba] machine group and pwdump.exe

[Beast]

Hi,

1. I want to migrate NT to Samba 3 domain without needing to rejoin all machine (using same domain name and SID). just curious, machine account should belong to what group sid? does it matter if belong to any value?
 
2. I just examine output of pwdump, some of member domain or even NT BDC is has "*****" in password field which means this account was disabled.
I've verified that machine is still valid member domain/bdc. it can browse network and do some administrative task.
Any explanation?

--beast