[Samba] winbind nss info = rfc2307 doesn't work when users not in "Users" Container?

[Christoph Peus]

Hi all,

we have been using a samba setup with samba being an AD member, idmap 
backend = ad and winbind nss info = rfc2307 for several month without 
problems yet.
But it turns out now that we cannot move useraccounts in AD from the
original location
"CN=Users,dc=uni-wh,dc=de"
to a newly created OU
"OU=uwhusers,dc=uni-wh,dc=de"
because winbind doesn't get correct values for homedir and shell anymore:

before: (correct output)
lunkwill samba # getent passwd test
test:*:51703:10645:test:/home/test:/bin/ksh

after: (wrong output)
lunkwill samba # getent passwd test
test:*:51703:10645:test:/home/UWH/test:/bin/false

This is perfectly reproducible by moving accounts from the Users 
container to the OU and back again. I can't believe that this is by 
design...
Any idea?

Our config:
samba 3.0.24

security = ADS
password server = *
ldap ssl = no
idmap uid = 1000-60000
idmap gid = 1000-60000
idmap backend = ad
winbind nss info = rfc2307
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind cache time = 300

Thanks for your help!

Christoph