When working with Linux servers integrated with Active Directory via winbind, one common frustration is group membership changes not being reflected in user sessions while appearing correctly in getent output. This typically manifests as:

[root@server ~]# groups username
username : domain_users old_group1 old_group2
[root@server ~]# getent group new_group
new_group:*:12345:username,otheruser

From troubleshooting similar cases, I've noticed this behavior often relates to:

• Winbind caching mechanisms (even when -n flag is used)
• SSSD vs pure winbind implementations
• Kerberos ticket refresh cycles
• Nested group resolution timing

First, verify the actual connection status and authentication flow:

# Check active winbind connections
lsof -i | grep winbind

# Verify user's group membership in AD
ldapsearch -x -LLL -h dc.example.com -D "user@DOMAIN" -W \
-b "CN=User Name,OU=Users,DC=domain,DC=com" "(sAMAccountName=user)" memberOf

# Check winbind debug logs (increase verbosity temporarily)
killall -USR1 winbindd
tail -f /var/log/messages | grep winbind

Solution 1: Full Credential Refresh

Sometimes the simplest approach works best:

# As the affected user:
kdestroy
kinit username@DOMAIN
# Then log out completely and log back in

Solution 2: Winbind Cache Manipulation

Even with -n flag, some caching occurs:

# Restart winbind service
service winbind restart

# Alternative: Clear specific cache entries
net cache flush

# For persistent issues, consider modifying smb.conf:
[global]
   winbind cache time = 0
   winbind enum users = yes
   winbind enum groups = yes
   winbind refresh tickets = yes

Solution 3: NSSwitch Configuration Check

Ensure your /etc/nsswitch.conf has correct group resolution order:

groups: files winbind

For stubborn cases, enable detailed logging:

# In smb.conf:
[global]
   log level = 3
   winbind debug level = 3
   winbind debug timestamp = yes

Then monitor logs while forcing a group resolution:

getent passwd username
groups username

• Consider migrating to SSSD for more reliable AD integration
• Implement regular credential refresh scripts
• Document all group changes requiring manual refresh procedures

---

When working with RHEL5 servers integrated with Active Directory via Winbind, we frequently encounter cases where AD group membership changes fail to reflect in the groups command output, despite being visible in getent group queries. This creates permission inconsistencies that can impact service accounts and user access.

The original scenario shows several important technical details:

[root@hcc1pl1 ~]# groups plubans
plubans : domain users systems infrastructure development

[root@hcc1pl1 ~]# getent group q1esb
q1esb:*:23136:q1qai,plubans,q1prodi

Notice the discrepancy where q1esb appears in getent but not in the user's group listing. The winbind connection appears healthy:

[root@hcc1pl1 ~]# lsof -i | grep winbind
winbindd  31339    root   17u  IPv4 63817934       TCP hcc1pl1:56541->hcnas01:microsoft-ds (ESTABLISHED)
winbindd  31339    root   21u  IPv4 63817970       TCP hcc1pl1:53622->hcnas01:ldap (ESTABLISHED)

Several factors could contribute to this behavior:

• Winbind cache artifacts (despite -n flag usage)
• SSSD interference (if installed alongside Winbind)
• Incorrect nsswitch.conf configuration
• Kerberos ticket expiration issues
• AD tokenGroups attribute not being refreshed

Begin with these diagnostic commands:

# Verify winbind operation mode
ps -ef | grep winbind

# Check name service switches
cat /etc/nsswitch.conf | grep -E 'group|passwd'

# Force cache clearance and reauthentication
net cache flush
kdestroy -A
kinit [username]

Modify your /etc/samba/smb.conf with these critical parameters:

[global]
    winbind refresh tickets = yes
    winbind offline logon = no
    winbind nested groups = yes
    winbind expand groups = 10
    winbind scan nested groups = yes

Then restart services:

service winbind restart
service smb restart

For persistent cases, enable debug logging:

# In smb.conf
    log level = 3 winbind:5
    debug timestamp = yes

Monitor logs in real-time:

tail -f /var/log/samba/log.winbind

For modern environments, consider migrating to SSSD:

yum install sssd oddjob-mkhomedir

# Configure /etc/sssd/sssd.conf
[sssd]
services = nss, pam
domains = yourdomain.com

[domain/yourdomain.com]
id_provider = ad
access_provider = ad
cache_credentials = True