Backup/restore of Samba4 and other basic assistance

[Dewayne]

The environment is a "simple" Samba4 using internal DNS and embedded heimdal. 

Help to understand
1. Why is there a krb5.conf under /usr/local/samba/private when the one that is used is/should be in /etc/krb5.conf?
2. /usr/local/samba/var/locks/sysvol has a GID of 3000000 - is this a protection  measure?
3. Would someone please direct me to the location of some doc re tdbbackup, ntdbbackup; as we need to understand how to
backup/restore prior to going into production.  I suspect that I need to stop Samba, before backing-up: 
samba/private/* 
samba/etc/* 
samba/var/locks/*
are there other areas that require regular backup.
Do we really need to stop Samba4 or do the tdbbackup tools enable a full saveset to be created?

Regards, Dewayne.