Why would the output of 'id' and 'id $USER' possibly be different?

I have samba/winbind configured on the backend, but the users aren't
getting all of their groups. The groups they ARE getting show up in
'id' (and take effect on the system). There are more that show up
when I run 'id $USER', but they don't take effect.