[Samba] groups command not listing supplementary groups

[Paul Griffith]

>>On Mon, 12 Jan 2026 14:46:06 +0000
>Paul Griffith via samba <samba at lists.samba.org> wrote:
>>
>> Hello Samba Team,
>>
>> We are experiencing a rather unusual issue with Samba.
>>
>> On some of our systems, the 'groups' command is not retrieving the
>> correct supplementary group membership and is causing various
>> permissions-based issues.
>>
>> For example:
>>
>> % groups webapp
>> webapp : webappg domain users
>>
>> Note that it shows webapp is only a part of webappg and "domain
>> users".
>>
>> What it should be showing (and shows on other machines):
>>
>noticeablereceive> % groups webapp
>> webapp : webappg domain users faculty hc_server submit hc_prismperformance
>> hc_public privkey
>>
>> Reboot the server, or even restarting winbind will cause the correct
>> group membership to come back.
>>
>
>Try adding 'winbind expand groups = 1' to the smb.conf on the client.
>
>Rowland


Adding 'winbind expand groups = 1' appears to work; we are still testing.  Two things we notice on the hosts we are testing: the groups command is certainly slower, and when we ssh into those hosts, there is a noticeable lag until we receive the command-line prompt.

I am still puzzled why 4.21.10 worked without the configuration option 'winbind expand groups = 1', and now, when we introduce it, we experience a performance hit.

Thanks
Paul
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba