This is the one that works:
# idmap dump -n
winuser:Guest@openindiana-server        ==      uid:2147483649
wingroup:Domain Users@openindiana-server        ==      gid:2147483650
wingroup:Guests@BUILTIN ==      gid:2147483652
winuser:Administrator@n4th4nr1ch.com    <=      uid:2147483650
wingroup:Spies@n4th4nr1ch.com   ==      gid:2147483661
winuser:nathanr@n4th4nr1ch.com  <=      uid:2147483651
wingroup:Domain Admins@n4th4nr1ch.com   <=      gid:2147483655
wingroup:Group Policy Creator Owners@n4th4nr1ch.com     ==      gid:2147483654
wingroup:Enterprise Admins@n4th4nr1ch.com       ==      gid:2147483656
wingroup:Schema Admins@n4th4nr1ch.com   ==      gid:2147483657
wingroup:Denied RODC Password Replication Group@n4th4nr1ch.com  ==      gid:2147483658
wingroup:Administrators@BUILTIN ==      gid:2147483660
winuser:nathanr@n4th4nr1ch.com  ==      uid:2147483653
wingroup:Domain Users@n4th4nr1ch.com    <=      gid:2147483653
winuser:Administrator@n4th4nr1ch.com    ==      uid:2147483652
wingroup:Network        ==      gid:2147483651
wingroup:Authenticated Users    ==      gid:2147483659
#