[Samba] Winbind allowing entire domain

[Jeff Gibson]

Hello.  I'm using winbind 3.0.10-1.4E.6 for logins on a RHEL4 box.  It's
working perfectly, but I'd like to restrict logins to only a few select
people in the windows domain.  By default winbind allows the entire
domain to login.  How can I restrict things?  I've tried adding "valid
users = user1" & "invalid users = user2" to my smb.conf but it doesn't
seem to do anything (I suspect those only works for the shares).  Has
anyone found a way to do this?  I've tried searching far and wide with
no workable results.  

Thanks for your help,
-Jeff G