Hi All.
Собрал squid+winbind с auth. Всё работает.
Решил разграничить доступ по домен группам. Создал двух пользователей –
test_user – група testgroup
admin_user – група domain admins (как понимаю BUILDIN)
Разграничение работает

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp                                                      
auth_param ntlm children 5                                                                                                          
auth_param ntlm keep_alive on                                                                                                      
external_acl_type r_group children=5 %LOGIN /var/squid/libexec/wbinfo_group.pl                                                      
external_acl_type vip_group children=5 %LOGIN /var/squid/libexec/wbinfo_group.pl                                                    
acl users proxy_auth REQUIRED                                                                                                      
#                                                                                                                                  
acl r-users external r_group "/var/squid/etc/r-users"                                                                              
acl vip-users external vip_group "/var/squid/etc/vip-users"  
…
#                                                                                                                                  
http_access deny r-users download                                                                                                  
http_access deny r-users black-list-site                                                                                            
http_access allow r-users                                                                                                          
http_access allow vip-users                                                                                                        
http_access deny all                                                                                                                
#                                                                                                                                  
http_reply_access deny r-users audio-video                                                                                          
http_reply_access allow r-users                                                                                                    
http_reply_access allow vip-users                                                                                                  
http_reply_access deny all                                                                                                          
#                                                                                                                                  
deny_info http://intranet.mysite.com black-list-site                                                                                
deny_info http://www.mysite.com download                                                                                            
#                                                            

root@squid:#cat r-users
testgroup
root@squid:#cat vip-users
domain admins
root@squid:#cat black-list-site
.microsoft.com
root@squid:#cat download-list  
\.mp3$
\.wma$
\.mov$
\.avi$

...
После этого – (ради теста) перевёл пользователя test_user из группы testgroup в группу domain admins.
На домене указал что эта группа для него PRIMARY
Проверил - всё вроде правильно:
root@squid:# id TEST\\admin_user
uid=10001(TEST\admin_user) gid=10000(TEST\domain admins) groups=10000(TEST\domain admins)
root@squid:# id TEST\\test_user
uid=10000(TEST\test_user) gid=10000(TEST\domain admins) groups=10000(TEST\domain admins)

Подключился через squid – на пользователя test_user  по прежнему срабатывают ограничения, как будто никакого изменения я не делал.
Пользователь admin_user работает без ограничений.

Вопрос тривиален – в чём могут быть грабли? Где и чего нужно поправить чтобы test_user стал полноценным участником группы domain admins?