samba - Jan 2026 - groups command not listing supplementary groups

On Mon, 12 Jan 2026 14:46:06 +0000
Paul Griffith via samba <samba at lists.samba.org> wrote:
> Hello Samba Team,
> 
> We are experiencing a rather unusual issue with Samba.
> 
> On some of our systems, the 'groups' command is not retrieving the
> correct supplementary group membership and is causing various
> permissions-based issues.
> 
> For example:
> 
> % groups webapp
> webapp : webappg domain users
> 
> Note that it shows webapp is only a part of webappg and "domain
> users".
> 
> What it should be showing (and shows on other machines):
> 
> % groups webapp
> webapp : webappg domain users faculty hc_server submit hc_prism
> hc_public privkey
> 
> Reboot the server, or even restarting winbind will cause the correct
> group membership to come back.
> 
Try adding 'winbind expand groups = 1' to the smb.conf on the client.

Rowland

>>On Mon, 12 Jan 2026 14:46:06 +0000
>Paul Griffith via samba <samba at lists.samba.org> wrote:
>>
>> Hello Samba Team,
>>
>> We are experiencing a rather unusual issue with Samba.
>>
>> On some of our systems, the 'groups' command is not retrieving
the
>> correct supplementary group membership and is causing various
>> permissions-based issues.
>>
>> For example:
>>
>> % groups webapp
>> webapp : webappg domain users
>>
>> Note that it shows webapp is only a part of webappg and "domain
>> users".
>>
>> What it should be showing (and shows on other machines):
>>
>noticeablereceive> % groups webapp
>> webapp : webappg domain users faculty hc_server submit
hc_prismperformance
>> hc_public privkey
>>
>> Reboot the server, or even restarting winbind will cause the correct
>> group membership to come back.
>>
>
>Try adding 'winbind expand groups = 1' to the smb.conf on the
client.
>
>Rowland

Adding 'winbind expand groups = 1' appears to work; we are still
testing.  Two things we notice on the hosts we are testing: the groups command
is certainly slower, and when we ssh into those hosts, there is a noticeable lag
until we receive the command-line prompt.

I am still puzzled why 4.21.10 worked without the configuration option
'winbind expand groups = 1', and now, when we introduce it, we
experience a performance hit.

Thanks
Paul
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba