diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index bbce55ea508..cf40633d127 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1420,6 +1420,7 @@ sub setup_ad_member_idmap_ad
 	idmap config $dcvars->{TRUST_DOMAIN} : range = 2000000-2999999
 	gensec_gssapi:requested_life_time = 5
 	winbind scan trusted domains = yes
+	winbind expand groups = 1
 ";
 
 	my $ret = $self->provision(