# getent group | grep "^tst" tst-tst1:x:50003: tst_tst2:x:50004: # getent group tst-tst1 ; echo $? tst-tst1:x:50003: 0 # getent group tst_tst2 ; echo $? 2 This happens on Suse Linux Enterprise Server 11 SP2, which originally names the version as 3.6.3-0.24.4, which seems to be 3.6.3 plus all vulnerabilty patches from up to 3.6.9. I needed the stability patches from bug 8807 et al, so I took the source package from Suse, injected the vanilla 3.6.9 sources and removed all Suse patches already applied in 3.6.9. relevant parts from smb.conf: [global] workgroup = XXX realm = XXX.LOCAL security = ADS map to guest = Bad User password server = adsrv01, adsrv02 passdb backend = tdbsam kerberos method = secrets and keytab printcap name = cups logon path = \\%L\profiles\.msprofile logon drive = P: logon home = \\%L\%U\.9xprofile template homedir = /usrhome/ad-user/%U template shell = /bin/bash winbind separator = + winbind enum users = Yes winbind enum groups = Yes winbind use default domain = Yes winbind refresh tickets = Yes winbind offline logon = Yes winbind normalize names = Yes idmap config * : range = 50000-59999 idmap config * : backend = tdb cups options = raw