smb.conf

[global]
        workgroup = DOMAIN
        realm = DOMAIN.NET
        idmap config * : backend = tdb
        idmap config * : range = 1000 - 9999
        idmap config DOMAIN:backend = rid
        idmap config DOMAIN:range = 10000 - 1073751823
        idmap config DOMAIN:schema_mode = rfc2307
        kerberos method = secrets and keytab
        security = ADS
#        winbind enum groups = yes
#        winbind enum users = yes
        winbind offline logon = yes
        winbind use default domain = yes
        template homedir = /home/%U
        template shell = /usr/bin/bash