Hi Andrew, i finally made it work. A very useful hint in docu/man wold be the -td flag used also for builtin domain groups: # smbgroupedit -c "Domain Admins" -u "Whatever Unix Group" -td The flag is missing in exactly this example. Is there a possibility to define the RID for a group, not getting it automatically when mapping it with smbgroupedit? btw, I solved the domain-sid-change-problem as you didn't give me an advice: I used a hex-editor to manipulate secrets.tdb :-) Thank you Martin _____________________________________________ MPREIS Warenvertriebs GmbH DI Martin Hechenberger, EDV-Entwicklung Landesstrasse 16, A-6176 V?ls Tel.: +43(512) 300 808 Fax.: +43(512) 3131 808 EMail : Martin.Hechenberger@mpreis.at _____________________________________________