[Samba] winbind idmap question

[Christian]

Hi,

how do I tell winbind to use "UserId" from AD, and not doing own mapping
of ID's ?
AD is win2003 R2 Std with sfu.

What I did/tried:
current (this did not work):

#      winbind separator = \
        winbind use default domain = Yes
        winbind nested groups = Yes
#      winbind cache time = 600
        template shell = /bin/bash
#      template homedir = /home/%D/%U
        template homedir = /home/%U
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        winbind enum groups = Yes
        winbind enum users = Yes
        security = domain
#      security = ads
# Where do we get our user information from?
        password server = srv-001.domain.local

tried (did not work, too, and is very slow finding users):
       winbind use default domain = Yes
       winbind nested groups = Yes
       winbind nss info = rfc2307

       idmap domains = DOMAIN

       idmap config DOMAIN:backend = ad
       idmap config DOMAIN:default = Yes
       idmap config DOMAIN:range = 10000 - 19999
       idmap config DOMAIN:schema_mode = rfc2307
        security = domain
#      security = ads
# Where do we get our user information from?
        password server = srv-001.domain.local

samba version is 3.2.7

Thanks for your ideas
Kind Regards
Chris