szenario: I have a group testgroup in AD that does not have a gidNumber attribute yet. getent group on DC1 and DC2 show gid 3000000 for testgroup. Then I add gidNumber attribute with value 10000 via the Unix properties via w2k8r2 remote admin tools. On the connected DC (DC1) nss winbind immerdiately shows the new gid 10000 for testgroup. On the second DC, replication is arriving immediately, so the new gid is in the sam.tdb but nss winbind keeps showing gid 3000000 for testgroup. The push of the updated nss information should be done right after such a thing changed - on all DCs not only on the DC that the remote admin tool was connected to.
ah, i think the second DC didn't have idmap_ldb:use rfc2307 enabled, only the first one. This parameter needs some documentation.