Winbind > 3.0.2 seems to have a problem mapping UIDs to SIDs correctly. 
 
Test (Samba 3.0.5 on Linux 2.4, AD-member, AD-Users have SID-History of 
previous NT4-Domain): 
 
> wbinfo -n DOMAIN1+USER1 
S-1-5-21-W-X-Y-Z User (1) 
 
(This SID is the correct SID of USER1 in the AD) 
 
> id DOMAIN1+USER1 
uid=30000(DOMAIN1+USER1) gid=30000(DOMAIN1+GROUP1) groups=30000
(DOMAIN1+GROUP1) 
 
 
> wbinfo -r DOMAIN1+USER1 
30001 
... 
... 
30137 
  
> wbinfo -n DOMAIN1+USER1 
S-1-5-21-A-B-C-D User (1) 
 
This SID is the SID of USER1 in the previous NT4-Domain, somehow the previous 
"wbinfo -r" did something nasty to ID-mapping, it looks like idmap got 
"poisoned" by "wbinfo -r".   
 
> id DOMAIN1+USER1 
id: DOMAIN1+USER1: No such user 
 
winbind logging corresponding to this invocation of id: 
 
[2004/08/18 08:43:01, 1] nsswitch/winbindd_ads.c:query_user(412) 
  query_user(sid=S-1-5-21-A-B-C-D): Not found 
[2004/08/18 08:43:01, 1] nsswitch/winbindd_user.c:winbindd_getpwnam(182) 
  error getting user info for user '[DOMAIN1]\[USER1]' 
 
winbind can't find the user because it is searching for the wrong SID. 
 
This problem occured after an update from 3.0.2 to 3.0.4/3.0.5. Reading from 
the changelog of 3.0.3: 
 
"New features introduced in Samba 3.0.3 include: 
... 
 o Support for local nested groups via winbindd. 
... 
" 
 
When I downgrade back to 3.0.2, this problem goes away. 
 
This (or a related?) problem seems to bother other people as well: 
http://marc.theaimsgroup.com/?l=samba&m=109170161202874&w=2 
http://marc.theaimsgroup.com/?l=samba&m=108853775903571&w=2