[Samba] SID history secondary group set bloat

[Rowland penny]

On 10/06/2021 09:05, Rowland penny via samba wrote:
> On 10/06/2021 08:59, Ralph Boehme wrote:
>> Am 10.06.21 um 09:55 schrieb Rowland penny via samba:
>>> Where he is getting multiple RIDs for the same group from.
>>
>> look at the Windows tokens he posted. He gets multiple UNIX ids 
>> because he has multiple SIDs for the same name which is result of the 
>> SID History Windows feature.
>>
>> Samba just mapps all those SIDs to UNIX ids.
>>
>> -slow
>>
>
> The more I learn about Active Directory, the less I know about it, 
> looks like I need to read up on SID history 😁
>
> Rowland
>
>
>

OK Ralph, from a brief bout of reading, it seems if you move an object 
from one domain to another, it gets a new SID and the old SID is stored 
in an attribute called 'sIDHistory'.

I think there are a couple of ways to sort this out, make windbind 
ignore the 'sIDHistory' attribute, or just remove all those attributes 
from AD.

Rowland