lookup_groupmem in winbindd_ads.c does not honour range retrieval of multivalued
attributes. 

for a description of "Incremental Retrieval of Multi-valued Properties" in LDAP
 see the (expired) draft at
http://www.watersprings.org/pub/id/draft-kashi-incremental-00.txt

thus any group in ads that does have more then 1000 (win2k) or 1500 (win2k3)
members appears to have 0 members if winbindd is used in ads-mode (by e.g.
getgrnam). this behaviour is caused because the ads_pull_strings-function is
just pulling the "member" attribute
from the ldap-result. instead winbindd in ads-mode should repeat ldap-queries
until all members were seen. therefor a new ads_pull_strings_range-function
should get the values from the ldap-result according to the current range. if
you have more values than the builtin limit in a ldap result, the
member-attribute will have the form "member;range=0-999" or
"member;range=0-1499" in the first query. the next query should then be directed
to member;range=1000-* or member;range=1500-*. the last range is indicated by a
trailing '*' in the first-attribute: member;4000-*.

testcase:

unpatched samba3.0.1pre2cvs:

   getent group "MYDOM\largegroup" gives:
   MYDOM\largegroup:x:2023:

with the patch:

   getent group "MYDOM\largegroup" gives:
   MYDOM\largegroup:x:2023:MYDOM\user001,MYDOM\user002, ...