with idmap backend = ad and winbind nss info = rfc2307 specified in smb.conf I have Samba correctly performing the id lookup in AD. What is the purpose in specifying an idmap uid/gid range in this configuration? Does Samba error when uids/gids stored in AD don't fall in the specified ranges? -Dan