I thought I got them working and it turned out I still have the same problem. This is a domain member server, joined to NT PDC. These commands are all working Ok: wbinfo -u, wbinfo -g, getent passwd, except getent group. It always stops at some point, I noticed these log messages: [2004/01/19 13:09:56, 10] nsswitch/winbindd.c:winbind_client_read(458) client_read: read 0 bytes. Need 1568 more for a full request. [2004/01/19 13:09:56, 5] nsswitch/winbindd.c:winbind_client_read(465) read failed on sock 22, pid 23630: EOF Some configuration entries in smb.conf: encrypt passwords = yes idmap uid = 10000-80000 winbind gid = 10000-80000 winbind enum users = yes winbind enum groups = yes winbind separator = + winbind use default domain = yes Here's how I compile Cyrus+SASL 2.1.17: ../configure --enable-shared --enable-gssapi=/usr/local/lib --with-openssl=/u sr/local/ssl I noticed in config.log, it says NTLM: disabled. Not sure if it matters here. Here's how I compile Samba 3.0.2rc1: ./configure --with-krb5=/usr --with-pam --with-libsmbclient --with-manpages- langs=en --with-winbind --with-ads --with-ldap --with-acl-support --with-libicon v=/usr/local I tried the above in Samba 3.0.1, Samba 3.0.2pre1, and Samba 3.0.2rc1 in Solaris 9, they all have the same "getent group" problem. But I noticed the winbindd in Samba 3.0.2rc1 handles "ls -l" request much faster than before. Thanks, Hai