This was working in Samba 4.5: $ getent passwd "$DOMAIN/Domain Users" ADDOMAIN/domain users:*:2000513:2000513::/home/ADDOMAIN/domain users:/bin/false $ echo $? 0 $ getent passwd 2000513 ADDOMAIN/domain users:*:2000513:2000513::/home/ADDOMAIN/domain users:/bin/false $ echo $? 0 $ ls -l testfile\ -rw-rw-r--. 1 ADDOMAIN/domain users ADDOMAIN/domain admins 0 Sep 23 12:24 testfile And stopped working in Samba 4.6 and newer versions: $ getent passwd "$DOMAIN/Domain Users" $ echo $? 2 $ getent passwd 2000513 $ echo $? 2 $ ls -l testfile -rw-r--r--. 1 2000513 ADDOMAIN/domain admins 0 Sep 23 12:30 testfile It looks like the behavior was introduced for Samba 4.5 through commit 394622ef8c916cf361f8596dba4664dc8d6bfc9e s3:winbindd: change getpwsid() to return a passwd struct for a group sid id-mapped with ID_TYPE_BOTH and then changed for Samba 4.6 through the patches around bce19a6efe11980933531f0349c8f5212419366a winbind: Restructure wb_getpwsid
Created attachment 15500 [details] Patches for 4.10
Created attachment 15501 [details] Patches for 4.11
Pushed to autobuild-v4-{11,10}-test.
(In reply to Karolin Seeger from comment #3) Pushed to both branches. Closing out bug report. Thanks!