Before trying what I suggest, understand it may reset UID/GID mappings that were created by Samba. I do this because everything I care about comes from Active Directory rfc2307 so I'm comfortable wiping Samba / Winbindd caches and starting over.
What finally worked for me was removing all the files from /var/cache/samba.
I recently battled getting the group list to update for just one stubborn user id. My user id of course.
I don't believe I am in a Cross Domain situation but it's possible. I'm in a large multi-domain Active Directory but was working with users and groups in just one domain.
I tried many attempts including "net cache flush", adding --no-caching to winbindd, and deleting group_mapping.tdb, winbindd_idmap.tdb, and winbindd_cache.tdb from /var/lib/samba.
Here is a script with commands that cleans out the Samba / Winbindd cache files:
#!/usr/bin/bash
#
# Quicky for backing up and removing the
# Samba / Winbindd cache files
#
# This solution worked when a single users group
# list would not update when changed in Active
# directory.
#
#
# Environment
#
# CentOS 7 with all updates as of 20150828
# Sernet Samba 4.2.3 - Version 4.2.3-SerNet-RedHat-18.el7
#
/usr/bin/sh /etc/init.d/sernet-samba-smbd stop
/usr/bin/sh /etc/init.d/sernet-samba-winbindd stop
/usr/bin/sh /etc/init.d/sernet-samba-nmbd stop
cd /var
/usr/bin/tar cbzf 512 samba_var_backup_`date '+%Y%m%d_%H%M%S'`.tgz cache/samba lib/samba log/samba
/usr/bin/find cache/samba -type f -exec /usr/bin/rm -f {} \;
/usr/bin/rm -f lib/samba/group_mapping.tdb
/usr/bin/rm -f lib/samba/winbindd_idmap.tdb
/usr/bin/rm -f lib/samba/winbindd_cache.tdb
/usr/bin/sh /etc/init.d/sernet-samba-nmbd start
/usr/bin/sh /etc/init.d/sernet-samba-winbindd start
/usr/bin/sh /etc/init.d/sernet-samba-smbd start
I believe I created the situation that caused my user id to not update. On this CentOS 7 system, I started off trying the "realm" command and SSSD method of talking to Active Directory using the CentOS 7 built in sssd and Samba which I think was Samba 4.1.x.
SSSD almost worked but was too slow. Commands like "id" and "groups" were horribly slow. It think Samba struggled because look ups were too slow.
I decided to try the latest Samba 4.2.x because of the new winbindd and default larger io.
Sernet Samba / Winbindd 4.2.3 appears to be working great. Samba joined Active Directory without a problem. Commands line "id" and "groups" are fast especially after the first lookup.
Here is my smb.conf for reference:
[global]
workgroup = PROJECTS
security = ads
realm = PROJECTS.EXAMPLE.NET
kerberos method = secrets and keytab
max log size = 50000
log level = 2
template homedir = /home/%U
template shell = /bin/bash
idmap config PROJECTS : default = yes
idmap config PROJECTS : backend = ad
idmap config PROJECTS : schema_mode = rfc2307
idmap config PROJECTS : range = 10000-9999999999
idmap config *:backend = tdb
idmap config *:range = 2000-3999
winbind nss info = rfc2307
winbind use default domain = yes
winbind offline logon = no
winbind enum groups = yes
winbind enum users = yes
winbind refresh tickets = yes
#
# 20150827 by Joe
# Comment out expand groups for now
# I added it trying to solve nested groups not working
# correctly. Look ups slowed down when I added this and
# did not solve the problem for my login.
#
## winbind expand groups = 3
os level = 0
local master = no
domain master = no
preferred master = no
# ------------------ Options Joe Likes ------------------------
#
path = /tmp
force create mode = 0775
force directory mode = 2775
unix extensions = no
wide links = yes
load printers = no
map archive = no
map readonly = permissions
nt acl support = no
#============================ Share Definitions ==============================
[projects]
path = /disks/projects/projects_share
comment = Projects Storage
writeable = Yes
browseable = yes
guest ok = no
