When installing the samba package, the postinst script may be calling mksmbpasswd to import the Unix user into the Samba user backend. This is controlled by the debconf variable samba/generate_smbpasswd, which currently default to false.
The way mksmbpasswd is called is indiscriminate, and will create a Samba user for all entries returned by getent passwd. This include system user (those with uid < 1000) such as root, games, lp, etc. While these users do not have a Samba password set (and hence cannot be used to connect to the Samba service), they are still very much unlikely to be useful in the context of Samba and should not be imported.
The best would be for mksmbpasswd to import only user with uid >= 1000, or at least have a blacklist of user it should not import.
Im having a look at this.
chuck