[Samba] How does one "look at AD" in Samba4.1?

[steve]

On Sun, 2014-03-16 at 10:52 +1000, Stuart Longland wrote:
> Hi all,

> 
> Not so good.  At this point I'm told to "look at AD and verify that all
> groups have GIDs".  I'm managing this from a Linux command line; how
> does one do this?

e.g. for Domain Users:
ldbedit --url=/usr/local/samba/private/sam.ldb cn=Domain\ Users

Now add something like RID+20000:
gidNumber: 20513

and remove these two lines:

idmap uid = 500-10000000
idmap gid = 500-10000000

now:
getent group Domain\ Users
will return.

HTH
Steve