valid users = @DOMAIN+somegroup doesn't work strangly
valid users = @somegroup (somegroup == ADS group name) works.
Same is true for write list. I'm using 3.0.23a sernet rpm's.
By the way I don't use 'winbind use default domain'. Is this behaviour by design or is it a bug? It clearly changed between 3.0.21c and 3.0.23a.
lookup_name()appears to not honuor the winbind separator
but rather assumes a '\'. Change your config to use
valid users = @"DOMAIN\name with spaces".
for a temporary workaround until 3.0.23b.
fixed in 3.0.23b