[Samba] Samba+ldap, Getent and AD (aka the good bad and the downright ugly)

[sysrm]

Hi all.

I have managed to join my samba server to an AD domain.

I can now join using the net command and get various other bits of info.

Wbinfo -u /g/t etc works nps

Getent however doesn't.

This is my question:

By reading various emails over the last 2 weeks and various howtos etc

In order to share users and passwords etc all I need to do is edit the
nsswitch.conf 

To 

passwd: compat winbind
shadow: compat
group: compat winbind

Or 

passwd: files winbind
shadow: files
group: files winbind

Then getent passwd SHOULD show the local passwd file AND the AD user file?

I don't need to do the pam auth stuff for this to work?

Is this correct or have I lost the plot (and very nearly the will to live??)

Please someone take pity on this poor fool.

Im running RH ES3 and samba 3.0.14a configured with
--prefix=/usr/local/samba --with-ldap --with-ads --with-krb5 --with-pam
--with-winbind

Thanks

Ross