diff --git a/freeradius-server.changes b/freeradius-server.changes
index 7921acd..4f49748 100644
--- a/freeradius-server.changes
+++ b/freeradius-server.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Fri Aug  7 10:56:29 UTC 2015 - jkeil@suse.de
+
+- Fix boo#912714: freeradius can't use ntlm_auth
+  * Create winbind group
+  * Add radiusd to winbind group
+
 -------------------------------------------------------------------
 Wed Jul  8 20:05:24 UTC 2015 - michael@stroeder.com
 
diff --git a/freeradius-server.spec b/freeradius-server.spec
index dd743e4..a67b2bd 100644
--- a/freeradius-server.spec
+++ b/freeradius-server.spec
@@ -284,6 +284,14 @@ rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/main/oracle
 %{_sbindir}/groupadd -r radiusd 2> /dev/null || :
 %{_sbindir}/useradd -r -g radiusd -s /bin/false -c "Radius daemon" -d \
                   %{_localstatedir}/lib/radiusd radiusd 2> /dev/null || :
+
+# boo#912714: add radiusd to winbind group for ntlm_auth
+# add winbind group and fail silently if it already exists
+%{_bindir}/getent group winbind \
+  || %{_sbindir}/groupadd -r winbind
+# add radiusd to winbind group
+%{_bindir}/gpasswd -a radiusd winbind
+
 %if 0%{?suse_version} > 1140
 %service_add_pre %{unitname}.service
 %endif