On Sat, Jun 29, 2024 at 11:50 AM Rowland Penny via samba <samba at lists.samba.org> wrote: > Have you given Domain Admins a gidNumber attribute ? Not sure. Should that group have one? How do I check that? > Did you run 'net cache flush' after making the change ? No, I did not. > Are you syncing idmap.ldb between the DCs ? Totally separate domains.