[global]
   workgroup = WORKGROUP
   server string = %h server (Samba %v)
   netbios name = ou-hostname
   hosts allow = 192.168.1.0/255.255.255.0, 127.0.0.1
   dns proxy = no


   log file = /var/log/samba/log.%m
   log level = 1 winbind:5 idmap:5 auth:5 sam:5
   max log size = 10000
;  syslog only = no
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

   security = ADS
   realm = KERBEROS.EXAMPLE.ORG
   kerberos method = secrets and keytab
   password server = *
   local master = no

   restrict anonymous = 1
   encrypt passwords = true
   passdb backend = tdbsam 
   obey pam restrictions = yes
   invalid users = root

   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n .

   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

    winbind enum users = no
    winbind enum groups = no
    winbind separator = .
    winbind nested groups = Yes
    winbind use default domain = Yes

    template shell = /bin/bash
    template homedir = /home/%U

    ; store the idmap for local non-AD accounts
    idmap backend = tdb
    idmap uid = 1000000000-10000000000
    idmap gid = 1000000000-10000000000
    ; use the readonly stored version in AD (I1110-4800)
    idmap config UOB : backend = ad
    idmap config UOB : range = 100-999999999
    idmap config UOB : schema_mode = rfc2307

[homes]
   comment = Home Directories
   browseable = no
   writable = yes
   create mask = 0700
   directory mask = 0700

include = /etc/samba/shares.conf
