- Create user or group with "Samba Authentication" checked.
- Edit the user/group and turn that option off.
- Go to the shell and run pdbedit -L or net groupmap list. The user/group will be in the list, but it should have been removed.
- Delete the user/group.
- Go back to the shell and repeat the command. The user/group will still be there.
For users, the reverse (off to on) also doesn't work, but you can trigger an update by changing the locked status, username, or password.