I have a problem with mapping pure domain group to one existing on UNIX system. When I map NT domain account by default samba picks local SID - one that can be acquired via the command; net getlocalsid Instead of SID that comes from domain; net getdomainsid This is the behavior that I do not understand. I can explicitly set the SID to the domain one. E.g.: net groupmap add sid=[DOMAIN SID]-[RID] ntgroup=[DOMAIN group] unixgroup=[UNIX group] type=l However the command getent group | grep 'DOMAIN group indicates this group to be domain one - GID created in accordance to RID backend in use, not the GID of 'UNIX group' as expected. Worth to mention I use the winbind. Strange thing is that I already have such mapping in place for other 'DOMAIN group2' that getent group reports with GID of local UNIX group with all members of the 'DOMAIN group2'. Now the question is how to populate such behavior for other of my groups???