When using AD group as CUPS "SystemGroup" and samba admin group, by setting "printer admin" and "write list" to that group's name, members of that group fail to get authorized for administring CUPS GUI and printers as well. Even seeing printer's configured queues is impossible. Group members authentication is successful ( I used wbinfo -a to validate that ). When some user is a member of Domain Local group only, using wbinfo -r to inspect user's AD group belonging, will return no group numbers ( as if this user does not belong to any AD group ).
please retest against 3.0.20a (the current SAMBA_3_0_RELEASE branch) which will publically be availebl next week.