I have a remote user, ISI\jhaltom, which is mapped to the local Unix user ISI\jhaltom using Winbind, idmap_ad and sfu. No entry for ISI \jhaltom appears in /etc/passwd. In /etc/group I have a local group "admin" who contains ISI\jhaltom in it's member list. When I change user to ISI\jhaltom and type groups, it shows him as a member of "admin". I have a share with valid users set to @admin. The user jhaltom cannot access the share, NT_STATUS_ACCESS_DENIED. Logs show that "ISI\jhaltom is not a member of valid users". Is Samba tracing down these local group memberships in the same way that NSS is?