"getent group group1" lists the users
"getent group group2" lists the users
"getent group group12" lists no one (i.e. where group12 in active directory just has group1 and group2 as members)

note: "wbinfo --group-info=group12" returns error "Could not get info for group group12", not sure if that helps

my smb.conf has "winbind nested groups = yes", but thinking that doesn't do anything (read somewhere that it's only for local groups, but regardless, switching to "no" and restarting services doesn't have any effect)

I'd rather not use ACL, and my backup plan is just to put everyone who's in the two groups into the combo group (and thus if ever adding or removing a member, would just have to remember to do it for two groups, not just one), but before going that route: is there some setting that would allow my Debian v6/Samba v3.5 server see members of a group (which is really just a group of groups)?