In my search for why domain groups are not working I've been reading through the source. I think that the doxygen stuff at http://samba.org/doxygen/samba/head/mapping_8c.html#a6 is at least 2 months out of date.
Here is why i think that... according to doxygen mapping.c has this 00189 sid_copy(&sid_admins, &global_sam_sid); 00190 sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS); 00191 sid_to_string(str_admins, &sid_admins); 00192 add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); according to my copy of cvs it has 187 sid_copy(&sid_admins, get_global_sam_sid()); 188 sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS); 189 sid_to_string(str_admins, &sid_admins); 190 add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "", privilege_all, PR_ACCESS_FROM_NETWORK|PR_LOG_ON_LOCALLY); according to cvs.samba.org those changes were made in rev 1.35 in june Globally replace 'global_sam_sid' with get_global_sam_sid(), a self initialising function. This patch thanks to the work of "Stefan (metze) Metzmacher" <[EMAIL PROTECTED]> This is partly to enable the transition to SIDs in the the passdb. Andrew Bartlett