https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto

debian# cp /etc/samba/smb.conf /root/

debian# apt purge samba samba-common

debian# apt autoremove

debian# rm -r /etc/samba/

root@gate:~# apt install winbind

freebsd# cat smb4.conf

linux# cat smb.conf

[global]
        workgroup = CORPX
        security = ADS
        realm = CORPX.UN
        kerberos method = system keytab
        winbind use default domain = Yes 

gate# net ads join -U Administrator

gate# host gate

freebsd# service samba_server start
или
linux# service winbind restart

gate# wbinfo -t
gate# wbinfo -u
gate# wbinfo -g

gate# net ads leave -U Administrator

gate# rm /etc/krb5.keytab

!!! Перезагрузить клиентов и сервисы

gate# net ads keytab create -U Administrator           # Возможно, это не обязательно

gate# net ads keytab add HTTP -U Administrator

gate# net ads keytab add imap -U Administrator

gate# net ads keytab add cifs -U Administrator         # Почему то не нужно, откуда берется, не понятно

gate# net ads keytab add xmpp -U Administrator         # С MS AD не работает, но, можно оставить через ktpass, с samba4 - OK ...

freebsd# ktutil list
или
linux# klist -ek /etc/krb5.keytab

Проверка:

C:\>setspn -L gate

[gate:~] # cat /etc/pam.d/sshd
...
auth       sufficient      /usr/local/lib/pam_winbind.so
auth       required        pam_unix.so             no_warn try_first_pass

root@gate:~# more /etc/pam.d/sshd
...
auth       sufficient  pam_winbind.so
# Standard Un*x authentication.
...

gate# cat smb.conf

[global]
        ...
        winbind use default domain = Yes
         
        winbind enum users = yes
        winbind enum groups = yes
        winbind cache time = 36
        idmap config * : range = 20000-40000
        template homedir = /home/%U
        template shell = /bin/sh

freebsd# service samba_server restart
или
linux# service winbind restart

!!! Тесты проходят с задержкой !!!

gate# wbinfo -n user1
gate# wbinfo -S ...
gate# wbinfo -i user1

gate# apt install libnss-winbind

gate# cat /etc/nsswitch.conf

...
group: files winbind
passwd: files winbind
shadow: files winbind   
...

debian# service nscd restart && service nscd reload

gate# id user1

gate# getent passwd

• Bug 12176 - wbinfo doesn't shows member users of a group any more

gate# getent group

gate# chown -R user1:'domain users' /home/user1/
gate# chown user1 /var/mail/user1

gate# chown -R user2:'domain users' /home/user2/
gate# chown user2 /var/mail/user2

gate# cat smb.conf 

[global]
        workgroup = CORPX
        security = DOMAIN
        winbind use default domain = Yes 

[gate:~] # /usr/local/etc/rc.d/samba stop
или
root@gate:~# /etc/init.d/winbind stop

gate# net rpc join -U root
Administrators's password: 
Joined domain CORPX

[gate:~] # /usr/local/etc/rc.d/samba start
или
root@gate:~# /etc/init.d/winbind start

gate# wbinfo -t

gate# wbinfo -u

gate# wbinfo -g

gate# ntlm_auth --username=user1
password: 
NT_STATUS_OK: Success (0x0)