We are testing the migration of our NT4 domain to a Samba 3 Domain.  Our member
servers are currently running Samba 2.2.8a on RedHat linux 9.  After migrating
~800 groups and ~8000 user/computer accounts to the Samba 3 DC with an openldap
backend we cannot successfully start winbindd on a Samba 2.2.8a member server
joined to the migrated domain.

In a network trace between the member server and the DC I see a query_dom_info
level 2 call that never completes.  Looking in rpc_server/srv_samr_nt.c I see
that Samba is loading each sam entry and iterating through them to get a count
of users and groups.

I worked around the problem by adding two new functions to the ldap passdb
backend, pdb_getusercount and pdb_getgroupcount.  These just do one ldap query
to get the number of groups or users.

Is there a better way to approach this problem.  I could probably tune my
openldap server better to avoid the timeout but I worry that won't work if we
want to scale to 100,000s of users.