samba - Nov 2009 - winbind vs w2k8r2, uid problem

hi!

can join and see users with wbinfo -u and getent passwd..
On w2k8r2 is identity management for unix installed so there are uid/gid 
infos inside...

winbind uses home dir and shell informations but dont uses uid/gid from 
ad... why?

example: my user has 10000 uid in ad but winbind/getent shows 10003.

My config:

[global]
    workgroup = CHAOS
    realm = CHAOS.LOCAL
    netbios name = SATAN
    password server = beelzebub.chaos.local
    server string = %h (Samba %v)
    security = ADS
    log level = 0
    log file = /var/log/samba/log.%m
    max log size = 50
    winbind use default domain = Yes
    winbind nested groups = Yes
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    idmap config CHAOS.LOCAL:backend = ad
    idmap config CHAOS.LOCAL:default = yes
    idmap config CHAOS.LOCAL:schema_mode = rfc2703
    winbind enum users = Yes
    winbind enum groups = Yes
    winbind nss info = rfc2307

I think this is the problem:

    winbind enum users = Yes
    winbind enum groups = Yes

but if I dont use them, I dont see the useres with getent passwd...

What Im doing wrong? Can someone give a hint?

Greetz