[Samba] Samba-winbind 3.5.4 primary group is always domain users!!!???

[Oliver Weinmann]

Dear All,

I stepped over a strange issue today. I have one installation of samba
winbind 3.3.2 on a Ubuntu machine. Changing the primary unix group of a
user is updated immediately. On a newer samba 3.5.4 installation the
primary group is not updated at all. It always displays "domain users".
Is there a new setting for the smb.conf? Here is my smb.conf:

[global]
        netbios name = gedail1
        realm = SOMEDOMAIN.NET
        workgroup = SOMEDOMAIN
        security = ADS
        encrypt passwords = true
        password server = server1.somedomain.net server2.somedomain.net
        os level = 20
        idmap backend = ad
        idmap config SOMEDOMAIN : backend = ad
        idmap config SOMEDOMAIN : schema_mode = sfu
        idmap config SOMEDOMAIN : range = 0-99999999
        winbind nss info = sfu
        winbind enum users = yes
        winbind enum groups = yes
        preferred master = no
        winbind nested groups = Yes
        winbind use default domain = Yes
        max log size = 50
        log level = 10
        log file = /var/log/samba/log.%m
        dns proxy = no
        wins server = 172.20.200.18 172.18.200.20
        allow trusted domains = no
        client use spnego = Yes
        use kerberos keytab = true
        winbind refresh tickets = yes
        idmap cache time = 1
        winbind cache time = 1

It's a W2k3 AD Domain.

Regards,
Oliver