Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an RHEL 6 server bound to an AD domain. Everything works fine but group lookups are extremely slow. Some lookups can take over 60 seconds. This is very painful when running sudo and when users ssh in and it needs to verify their group membership before granting access. Strangely, when it comes to file permissions, there is no lag when a group is used to limit access via ACL's.

It seems like when groups are looked up, every single member of each group is enumerated. Some groups have over 100,000 members.

Here is my Winbind config:

workgroup = EXAMPLE
password server = AD.EXAMPLE.ORG
security = ads
idmap uid = 10000-19999
idmap gid = 10000-19999
idmap config EXAMPLE:backend = rid
idmap config EXAMPLE:range = 10000000-19999999
winbind enum users = no
winbind enum groups = no
winbind separator = +
template homedir = /home/%U
template shell = /bin/bash
winbind use default domain = yes
winbind offline logon = false
share|improve this question
have you tried using idmap backend = tdb? ps aux | grep winbind – c4f4t0r Jan 4 '14 at 7:57
Will that mode create identical uid/gid on separate systems? That's why I went with rid to begin with. – Marty Jan 5 '14 at 22:18
if you want to have your user id between servers, you can try as idmap backend ldap, for more information about your problem… – c4f4t0r Jan 5 '14 at 23:30
I replaced rid with ldap in the config but I notice no difference in group lookup speed. – Marty Jan 6 '14 at 2:52
have you tried sssd+kerberos on redhat 6 with sfu on windows server for user unix scheme? – c4f4t0r Jan 6 '14 at 11:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.