[Samba] "Unwilling to Perform" UNIX Attributes

[Michael W. Lucas]

Hi,

I'm running Samba 4.0.8, on FreeBSD 9.2, from operating system
packages, as a DC. I have a BDC, running the same. I'm using a Windows
7 workstation with "Active Directory Users and Computers" snap-in to
manage usernames, passwords, etc. The workstation is part of the
domain, and I'm logged on as Administrator in the domain.

I can create groups and add members to them when I create them. When I
go back to edit group memberships, however, and I select "UNIX
Attributes," I get the message "Unwilling to Perform." (While I can
view things, and even tell the GUI to add them, unsurprisingly, no
actual change is made.)

No message appears in any of the samba4 logs.

How should I troubleshoot this kind of problem?

Other possibly relevant details:

There's an OpenLDAP proxy between the 

Some Unix machines will authenticate via pure LDAP, no Kerberos

I use LdapAdmin to view the AD information, to help troubleshoot
actually getting pure LDAP auth working. I do not change anything via
LdapAdmin, changes happen via the snap-in or by adding clients to the
domain at the client.

Thanks,
==ml

-- 
Michael W. Lucas  -  mwlucas at michaelwlucas.com, Twitter @mwlauthor 
http://www.MichaelWLucas.com/, http://blather.MichaelWLucas.com/
Absolute OpenBSD 2/e - http://www.nostarch.com/openbsd2e
coupon code "ILUVMICHAEL" gets you 30% off & helps me.