[Samba] smbladp_conf shell opts

[listserv.traffic at sloop.net]

I'm setting up a smaba/ldap server and I'd really like "regular" samba
users to not have local login privs. (LDAP will handle all unix and
samba accounts.)

So, to that end, I thought changing the options in smbldap.conf,
specifically...

userLoginShell="/bin/bash"
to something like
userLoginShell="/sbin/nologin"

Is there some unanticipated impact that would make this unwise?
Is this the best way to accomplish the task?
Finally, are there other places I need to handle this for it to work
as I intend?

TIA
-Greg