samba - Jun 2015 - Active Directory group membership changes not reflected in winbind information

Hi,
I?ve added an existing group (?2d3d?) to an existing user (?jschopp?) on our AD
server. When I execute ?id jschopp? the new group membership is not reflected:

# id jschopp
uid=1333(jschopp) gid=2020(dom?nen-benutzer)
groups=2020(dom?nen-benutzer),610(BUILTIN+users)

This is a strange behavior. Is this a caching issue?

Kind regards,
Martin

AD: Windows Server 2008 RC2 with Windows Services for UNIX
AD member: CentOS 6.6, sernet-samba-4.1.14-9

This is my Samba/Winbind configuration:

[global]

        workgroup = ARRI
        server string = Samba Server Version %v
        netbios name = BARBARELLA

        # logs split per machine
        log file = /var/log/samba/%m.log
        # max 50KB per log file, then rotate
        max log size = 50
        log level = 3

        security = ads
        realm = ARRI.DE
        encrypt passwords = Yes

        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind nested groups = Yes
        winbind separator = +
        winbind offline logon = false
;       winbind nss info = template rfc2307
;       idmap config ARRI:backend = rid
;       idmap config ARRI:range = 10000-99999
        idmap config * : backend = tdb
        idmap config * : range = 600-799
        idmap config ARRI:backend = ad
        idmap config ARRI:range = 800-19999
        idmap config ARRI:schema_mode = rfc2307
;       idmap config *:range = 16777216-33554431
;       idmap uid = 600-20000
;       idmap gid = 600-20000

        allow trusted domains = Yes
        server signing = mandatory
        client signing = mandatory
        client use spnego = Yes
        ntlm auth = Yes
        lanman auth = No

# --- Kerberos ---
;       kdc:service ticket lifetime = 24
;       kdc:user ticket lifetime = 24
;       kdc:renewal lifetime = 120

? shares following



Martin Markert
Systems Integrator
 

Tuerkenstr. 89, 80799 M?nchen / Germany
Phone +49 89 3809-1848

EMail MMarkert at arri.de

  Visit us on Facebook!________________________________
 [http://www.arricommercial.de/wp-content/uploads/2015/04/2015-04-16a-E-mail-Signatur_ARRI_Media.jpg]
<http://www.arri.de/filmtv>

Get all the latest information from
www.arri.de/filmtv<http://www.arri.de/filmtv>,
Facebook<https://www.facebook.com/pages/ARRI-Film-TV/117731121606986?fref=ts>

ARRI Media GmbH
Sitz: M?nchen - Registergericht: Amtsgericht M?nchen
Handelsregisternummer: HRB 69396
Gesch?ftsf?hrer: Franz Kraus; Dr. J?rg Pohlman; Josef Reidinger

On Mon, Jun 08, 2015 at 10:46:33AM +0000, Markert, Martin
wrote:
> Hi,
> I?ve added an existing group (?2d3d?) to an existing user (?jschopp?) on
our AD server. When I execute ?id jschopp? the new group membership is not
reflected:
> 
> # id jschopp
> uid=1333(jschopp) gid=2020(dom?nen-benutzer)
groups=2020(dom?nen-benutzer),610(BUILTIN+users)
> 
> This is a strange behavior. Is this a caching issue?
Yes. Please re-login to the server to update that info.

With best regards,

Volker Lendecke

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de

Hi Volker,
thank you for your answer. What do you mean? Restarting winbind?

Kind regards,
Martin
> 
Martin Markert
Systems Integrator
 

Tuerkenstr. 89, 80799 M?nchen / Germany
Phone +49 89 3809-1848

EMail MMarkert at arri.de

  Visit us on Facebook!Am 08.06.2015 um 13:06 schrieb Volker Lendecke
<Volker.Lendecke at SerNet.DE>:
>
> On Mon, Jun 08, 2015 at 10:46:33AM +0000, Markert, Martin wrote:
>> Hi,
>> I?ve added an existing group (?2d3d?) to an existing user (?jschopp?)
on our AD server. When I execute ?id jschopp? the new group membership is not
reflected:
>>
>> # id jschopp
>> uid=1333(jschopp) gid=2020(dom?nen-benutzer)
groups=2020(dom?nen-benutzer),610(BUILTIN+users)
>>
>> This is a strange behavior. Is this a caching issue?
>
> Yes. Please re-login to the server to update that info.
>
> With best regards,
>
> Volker Lendecke
>
> --
> SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen
> phone: +49-551-370000-0, fax: +49-551-370000-9
> AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen
> http://www.sernet.de, mailto:kontakt at sernet.de
________________________________
 [http://www.arricommercial.de/wp-content/uploads/2015/04/2015-04-16a-E-mail-Signatur_ARRI_Media.jpg]
<http://www.arri.de/filmtv>

Get all the latest information from
www.arri.de/filmtv<http://www.arri.de/filmtv>,
Facebook<https://www.facebook.com/pages/ARRI-Film-TV/117731121606986?fref=ts>

ARRI Media GmbH
Sitz: M?nchen - Registergericht: Amtsgericht M?nchen
Handelsregisternummer: HRB 69396
Gesch?ftsf?hrer: Franz Kraus; Dr. J?rg Pohlman; Josef Reidinger