samba - Sep 2003 - auth failure on samba server + winbind wierdness(trust with unix kerberos realm problem?)

I'm most of the way through getting 3.0rc2 as a 2k3 AD member working.

smbclient -L windows_machine -U win_user -k   works
smbclient -L samba_machine -N	works
smbclient -L samba_machine -U win_user -k  says
session setup failed: NT_STATUS_LOGON_FAILURE

This is where it gets strange:

restart winbind
getent passwd	only shows local users
id WIN\\luser	user not found
wbinfo -u	"Error looking up domain users"
wbinfo -m	lists our unix kerberos realm (we set up a trust)
wbinfo -u	works
getent passwd	lists domain and local users
id WIN\\luser	user found

this is reproducable everytime.
I expected the alternate kerberos name mappings to not work under samba 
yet, but WIN\luser doesn't use the other realm.

any ideas?

david