I'm using samba 3.0.22 as a domain member in a AD domain and it is setup with winbind and idmapping. I am unable to change the primary group on a directory using the WinXP File->Properties->Security dialog although I am able to change it with smbcacls: smbcacls '//localhost/acltest' "/dir" -G "TDOM\staff" -U myuser Is this intended functionality or something not yet implemented? This machine is running HP-UX 11i and the filesystem is vxfs. root@fssrv13:/->testparm -sv|grep acl Load smb config files from /opt/samba322/lib/smb.conf Processing section "[acltest]" Loaded services file OK. WARNING: passdb expand explicit = yes is deprecated Server role: ROLE_DOMAIN_MEMBER acl compatibility acl check permissions = Yes acl group control = Yes acl map full control = Yes force unknown acl user = No inherit acls = No nt acl support = Yes profile acls = No map acl inherit = No -- Tomas Edwardsson