[global]
        dos charset = CP866
        unix charset = KOI8-R
        display charset = KOI8-R
        workgroup = WORKGROUP
        realm = WORKGROUP.LOCAL
        server string = FLYING_TOASTER
        preferred master = no
        security = ads
        auth methods = winbind
        map to guest = Bad User
        password server = <твой сервер AD>
        client NTLMv2 auth = Yes
        log level = 10
        log file = /var/log/samba/log.%U
        max log size = 50
        acl compatibility = auto
        client signing = Yes
        load printers = No
        disable spoolss = Yes
        os level = 10
        preferred master = No
        local master = No
        domain master = No
        dns proxy = No
        idmap uid = 10000-15000
        idmap gid = 10000-15000
        winbind separator = #
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        hosts allow = <твоя сеть>, 127.
        case sensitive = No
        enhanced browsing = Yes

# Access only for mentioned groups
[samba]
        path = /home/Samba/samba
        valid users = @"DOMAIN#Accounts Department" @"DOMAIN#sysadmins"
        read only = No
        create mask = 0777
        directory mask = 0777
        guest ok = No
        force group = root

# read anyone
@ write only "write list" members
[QA]
        path = /home/Samba/QA
        public = yes
        write list = @"DOMAIN#smb_qa"
        create mask = 0777
        directory mask = 0777
        guest ok = No
# used for disk quota
        force user = megaball
        force group = megaball

192.168.xxx.xxx  DOMAIN.LOCAL DOMAIN
192.168.xxx.xxx   TOASTER.DOMAIN.LOCAL TOASTER

[logging]
    default = FILE:/var/log/krb5/krb5libs.log
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log

[libdefaults]
    ticket_lifetime = 24000
    default_realm = DOMAIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    kdc_req_checksum_type = 2
    checksum_type = 2
    ccache_type = 1
    forwardable = true
    proxiable =true
    default_etypes = des-cbc-crc des-cbc-md5
    default_etypes_des = des-cbc-crc des-cbc-md5

[realms]
DOMAIN.LOCAL = {
    kdc = 192.168.xxx.xxx:88
    admin_server = 192.168.xxx.xxx:749
    default_domain = DOMAIN.LOCAL
}

[domain_realm]
    .DOMAIN.LOCAL = DOMAIN.LOCAL

[pam]
    debug = false
    ticket_lifetime = 36000
    renew_lifetime = 36000
    forwardable = true
    krb4_convert = false

[login]
    krb4_convert = false
    krb4_get_tickets = false

passwd:     files winbind
shadow:     files winbind
group:      files winbind

#!/bin/bash
kinit megaadmin@DOMAIN.LOCAL
rm -f /var/log/samba/*
net ads join -U megaadmin
/etc/init.d/smb restart
/etc/init.d/winbind restart