User and Group ID Allocation
When a user or group is created under Windows NT/200x,
it is allocated a numerical relative identifier (RID). This is
slightly different from UNIX, which has a range of numbers that are
used to identify users and the same range used to identify
groups. It is Winbind's job to convert RIDs to UNIX ID numbers and
vice versa. When Winbind is configured, it is given part of the UNIX
user ID space and a part of the UNIX group ID space in which to
store Windows NT users and groups. If a Windows NT user is
resolved for the first time, it is allocated the next UNIX ID from
the range. The same process applies for Windows NT groups. Over
time, Winbind will have mapped all Windows NT users and groups
to UNIX user IDs and group IDs.
The results of this mapping are stored persistently in
an ID mapping database held in a tdb database. This ensures that
RIDs are mapped to UNIX IDs in a consistent way.