[Samba] getent group fails on member server after upgrade to 3.5.5

[Neil Price]

  I have a member server joined to a samba 3 domain. It was working fine 
with 3.4.8 but after an upgrade to 3.5.5 (debian lenny with backports) 
getent group no longer works.

getent passwd works fine, wbinfo -u and wbinfo -g work fine

I upgraded some other servers which are DC's and those work fine.

winbind.log shows
[2010/10/21 14:06:13.918006,  3] 
winbindd/winbindd_misc.c:352(winbindd_interface_version)
   [16709]: request interface version
[2010/10/21 14:06:13.918103,  3] 
winbindd/winbindd_misc.c:385(winbindd_priv_pipe_dir)
   [16709]: request location of privileged pipe
[2010/10/21 14:06:13.918288,  3] 
winbindd/winbindd_getgrent.c:51(winbindd_getgrent_send)
   [16709]: getgrent
[2010/10/21 14:06:14.618332,  5] 
winbindd/winbindd_getgrent.c:149(winbindd_getgrent_recv)
   getgrent failed: NT_STATUS_NONE_MAPPED

Relevant parts of smb.conf

security = domain
    ldap ssl = Off

    idmap backend = ldap:ldap://170.130.105.39
    idmap uid = 80000-90000
    idmap gid = 80000-90000
    idmap alloc backend = ldap
    idmap alloc config: ldap_url = ldap://170.130.105.39
    idmap alloc config: ldap_base_dn = ou=idmap,dc=gibb,dc=co,dc=za
    idmap alloc config: ldap_user_dn = 
cn=admin,ou=people,dc=gibb,dc=co,dc=za
    idmap alloc config: range = 80000-90000

password server = *
    winbind enum groups = yes
    winbind enum users = yes

Relevant part of nsswitch.conf
passwd:         compat winbind
group:          compat winbind
shadow:         compat

hosts:          files dns wins