Ok, I figured it out... on the pam.d sshd module the system-auth (which in my case holds the winbind auth) was not included. Including this module will do. So checking first for sshd directives and then including the system-auth will check for AD password match. Thank you.