lib/param: change the default for "winbind expand groups" to "0"

Expanding groups requires the usage of SAMR, which is often not possible
with the trust account credentials. This has caused a lot of trouble
in the past, as this is the only operation which requires a member to
contact a dc of a trusted domain directly, which is not always possible.
With this changed default, it should only be required to contact
a dc of our own domain. This is the correct behavior for a domain member.

As expanding groups is mostly cosmetic, we should avoid it.
This is similar to "winbind enum users" and "winbind enum groups",
which are also off by default.

Only some broken applications calculate the group memberships of
users by traversing groups, such applications will require
"winbind expand groups = 1".

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Björn Jacke <bj@sernet.de>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 31 18:48:36 CEST 2014 on sn-devel-104

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 480f970b02e..21798d90d3e 100644
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2672,7 +2672,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
 
 	lpcfg_do_global_parameter(lp_ctx, "ldap connection timeout", "2");
 
-	lpcfg_do_global_parameter(lp_ctx, "winbind expand groups", "1");
+	lpcfg_do_global_parameter(lp_ctx, "winbind expand groups", "0");
 
 	lpcfg_do_global_parameter(lp_ctx, "stat cache", "yes");