Common bugs fixed in 3.0.23b include:

  o Ambiguity with unqualified names in smb.conf parameters
    such as "force user" and "valid users".
  o Errors in 'net ads join' caused by bad IP address in the list
    of domain controllers.
  o SMB signing errors in the client and server code.
  o Domain join failures when using smbpasswd on a Samba PDC.

Common bugs fixed in 3.0.23a include:

  o Failure to strip the domain name from groups when 'winbind 
    use default domain = yes'
  o Failure in pam_winbind to correctly parse arguments.
  o Bad token creation of local users on member servers not 
    running winbindd.
  o Failure to add users or groups to ACLs using the Windows
    object picker.
  o Failure in file serving code when 'kernel oplocks = yes'.

New features in 3.0.23a include:

  o New "createupn" option to "net ads join"
  o Rewritten Kerberos keytab generation when 'use kerberos 
    keytab = yes'

How-To-Repeat: 

UPDATING:

Since Samba 3.0.8, it has been recommended that all domain accounts 
listed in smb.conf on a member server be fully qualified with the 
domain name.  This is now a requirement.  All unqualified names are 
assumed to be local to the Unix host, either as part of the server's 
local passdb or in the local system list of accounts (e.g. /etc/passwd 
or /etc/group).

If the member server is not running winbindd at all, domain 
accounts will be implicitly mapped to local accounts and their
tokens will be modified appropriately to reflect the local 
SID and group membership.