AD Groups

Hi.. I have an OS X Server 10.3.4 bound to my Win2003 AD controller. I’m configuring the LDAP mappings, in Directory Access. I’ve got the Workgroup Manager to show me the groups list from the AD server, and even the members of those groups, but the systems isn’t enforcing permissions on it properly.

example…

tom, dick, harry = users on AD server
tunnels = AD group of above three users

on OS X server, create AFP share “test”. Assign permissions user, group, world: read-only, read-write, none, respectively. user is admin, group is set to the tunnels group from the AD server.

login from OS X 10.3 workstation to OS X server as user tom… login ok… only presented with the Mac’s three default shares: Public, Groups, Users. I expect to see the test share, but i don’t. If I set the user of the share to be tom, and set the group to not be tunnels (something else), then tom can see the share.

I’m also getting warnings in Workgroup Manager about PresetUsers and PresetGroups not mapped. What can I map them to?

I’ve set my Groups mappings, in DirectoryAccess, to:

Groups – group
PrimaryGroupID – primaryGroupID
Group Membership – userlist
Member – user

any comment is appreciated