domain users only have 1 group !!!
 

I am authenticating users against active directory using samba/winbind but I notice that when doing
it only shows the user as belonging to one group, by default domain users.

I know I can change the primary group in ad to change this but what I really want is for the users to belong to serveral groups instead so that I can give them access to various things by group memberships.

Is is possible to have the domain users belong to multiple groups? Is so how?

What have you done regarding group memberships and using them to assign permissions to files or shares?

Yes.

RT:)M usermod, especially "-G".

I run single user machines & don'tuse this feature much, except when I happen to create something w/ root & need to change the ownerships from "root root", to "root users".

errrrr, I know how to do unix.

The question was about domain group memberships (and yes I know how to do that too)

the problems was the domain group memberships weren't resolved, but it looks like it sorted itself out, must have been a timing thing cos it was newly done, probably just needed some time. This is strictly a winbind+krb thing.

When we first setup our File Server, we discovered a caching problem with the 'nscd' service.

You may need to restart this service when making changes to groups etc