[Samba] winbind nss configuration

[Jerome Haltom]

I'm having the hardest time trying to come up with the optimal
configuration with NSS Winbind support. I want it to work right offline.
That is, name lookups shouldn't take 30 minutes to time out or lock the
system up. And if the name lookup is for a local name, I want Winbind to
be 100% out of hte picture.

I've tried this, without much luck:

passwd: compat [SUCCESS=return] winbind
groups: compat [SUCCESS=return] winbind

My naive understanding is that this would make name lookups that
suceeded in `compat` completely avoid winbind. That was my understanding
until I disconnected the machine and could not log in as root.

What am I missing?