[Samba] groups command not listing supplementary groups

[Rowland Penny]

On Wed, 14 Jan 2026 14:05:45 +0000
Paul Griffith <paulg at yorku.ca> wrote:

> 
> >>On Mon, 12 Jan 2026 14:46:06 +0000
> >Paul Griffith via samba <samba at lists.samba.org> wrote:
> >>
> >> Hello Samba Team,
> >>
> >> We are experiencing a rather unusual issue with Samba.
> >>
> >> On some of our systems, the 'groups' command is not retrieving the
> >> correct supplementary group membership and is causing various
> >> permissions-based issues.
> >>
> >> For example:
> >>
> >> % groups webapp
> >> webapp : webappg domain users
> >>
> >> Note that it shows webapp is only a part of webappg and "domain
> >> users".
> >>
> >> What it should be showing (and shows on other machines):
> >>
> >noticeablereceive> % groups webapp
> >> webapp : webappg domain users faculty hc_server submit
> >> hc_prismperformance hc_public privkey
> >>
> >> Reboot the server, or even restarting winbind will cause the
> >> correct group membership to come back.
> >>
> >
> >Try adding 'winbind expand groups = 1' to the smb.conf on the client.
> >
> >Rowland
> 
> 
> Adding 'winbind expand groups = 1' appears to work; we are still
> testing.  Two things we notice on the hosts we are testing: the
> groups command is certainly slower, and when we ssh into those hosts,
> there is a noticeable lag until we receive the command-line prompt.
> 
> I am still puzzled why 4.21.10 worked without the configuration
> option 'winbind expand groups = 1', and now, when we introduce it, we
> experience a performance hit.
> 

It is a bit strange, the default was changed a long time ago and as for
why it is slower, see the 'winbind expand groups' section of the
smb.conf manpage.

Rowland