[Samba] getent group not working

[steve]

Hi
Ubuntu 12.04 LTS client with 3.6.3 joined to the Samba4 AD domain.
smb.conf
winbind enum users = Yes
winbind enum groups = Yes
idmap config *:backend=tdb
idmap config *:range=10000-19999
idmap config ALTEA:backend=ad
idmap config ALTEA:range=20000-40000000

getent passwd and wbinfo -u returns all AD users correctly
wbinfo -g returns all AD groups correctly
getent group fails. Only local groups are returned.

getent group works OK on the Samba4 DC.

I have disabled firewalls at both ends and torn down apparmor at both ends.

Any ideas anyone?
Cheers,
Steve