I have similar cases on this thread at AD group membership changes not reflected in winbind information. The only difference is that this only occurs on "cross domain" for my scenario.

Here is my configuration - http://pastebin.ca/3035431 ...

I would appreciate if anyone could shed me some lights on:

(1) how to let "id" command reflect the correct group membership.

(2) how can I make Winbind to reflect the group membership automatically once there is changes have been made in Active Directory.



Before trying what I suggest, understand it may reset UID/GID mappings that were created by Samba. I do this because everything I care about comes from Active Directory rfc2307 so I'm comfortable wiping Samba / Winbindd caches and starting over.

What finally worked for me was removing all the files from /var/cache/samba.

I recently battled getting the group list to update for just one stubborn user id. My user id of course.

I don't believe I am in a Cross Domain situation but it's possible. I'm in a large multi-domain Active Directory but was working with users and groups in just one domain.

I tried many attempts including "net cache flush", adding --no-caching to winbindd, and deleting group_mapping.tdb, winbindd_idmap.tdb, and winbindd_cache.tdb from /var/lib/samba.

Here is a script with commands that cleans out the Samba / Winbindd cache files:


# Quicky for backing up and removing the
# Samba / Winbindd cache files
# This solution worked when a single users group
# list would not update when changed in Active
# directory.
# Environment
# CentOS 7 with all updates as of 20150828
# Sernet Samba 4.2.3 - Version 4.2.3-SerNet-RedHat-18.el7

/usr/bin/sh /etc/init.d/sernet-samba-smbd stop
/usr/bin/sh /etc/init.d/sernet-samba-winbindd stop
/usr/bin/sh /etc/init.d/sernet-samba-nmbd stop

cd /var

/usr/bin/tar cbzf 512 samba_var_backup_`date '+%Y%m%d_%H%M%S'`.tgz cache/samba lib/samba log/samba

/usr/bin/find cache/samba -type f -exec /usr/bin/rm -f {} \;

/usr/bin/rm -f lib/samba/group_mapping.tdb
/usr/bin/rm -f lib/samba/winbindd_idmap.tdb
/usr/bin/rm -f lib/samba/winbindd_cache.tdb

/usr/bin/sh /etc/init.d/sernet-samba-nmbd start
/usr/bin/sh /etc/init.d/sernet-samba-winbindd start
/usr/bin/sh /etc/init.d/sernet-samba-smbd start

I believe I created the situation that caused my user id to not update. On this CentOS 7 system, I started off trying the "realm" command and SSSD method of talking to Active Directory using the CentOS 7 built in sssd and Samba which I think was Samba 4.1.x.

SSSD almost worked but was too slow. Commands like "id" and "groups" were horribly slow. It think Samba struggled because look ups were too slow.

I decided to try the latest Samba 4.2.x because of the new winbindd and default larger io.

Sernet Samba / Winbindd 4.2.3 appears to be working great. Samba joined Active Directory without a problem. Commands line "id" and "groups" are fast especially after the first lookup.

Here is my smb.conf for reference:

workgroup = PROJECTS
security = ads
kerberos method = secrets and keytab

max log size = 50000
log level = 2

template homedir = /home/%U
template shell = /bin/bash

idmap config PROJECTS : default = yes
idmap config PROJECTS : backend = ad
idmap config PROJECTS : schema_mode = rfc2307
idmap config PROJECTS : range = 10000-9999999999
idmap config *:backend = tdb
idmap config *:range = 2000-3999

winbind nss info = rfc2307
winbind use default domain = yes
winbind offline logon = no
winbind enum groups = yes
winbind enum users = yes
winbind refresh tickets = yes

# 20150827 by Joe
# Comment out expand groups for now
# I added it trying to solve nested groups not working
# correctly. Look ups slowed down when I added this and
# did not solve the problem for my login.
## winbind expand groups = 3

os level = 0
local master = no
domain master = no
preferred master = no

# ------------------ Options Joe Likes ------------------------

path = /tmp
force create mode = 0775
force directory mode = 2775
unix extensions = no
wide links = yes
load printers = no
map archive = no
map readonly = permissions
nt acl support = no

#============================ Share Definitions ==============================

        path = /disks/projects/projects_share
        comment =  Projects Storage

        writeable = Yes
        browseable = yes
        guest ok = no
| improve this answer | |

It seems that this deletes the cache and forces winbind to pull information from ADC:

service winbind stop
rm /var/cache/samba/netsamlogon_cache.tdb
service winbind start
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.