I came across this some time ago and I finally decided to report it: When I input "pdbedit -Lv root" I get: Primary Group SID: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-513 But if I use "smbldap-usershow root" i get: Primary Group SID: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-512 If I inspect the LDAP database with any other tool, the stored value is 512 (Domain Admins). So, where is pdbedit reading the 513 (Domain Users) from? I thought that, since I have a LDAP backend, it should be reading it from the LDAP database... This has happened both in Samba 3.2.x and all of the 3.5.x releases. I didn't try 3.3.x and 3.4.x.