#vi /etc/nsswitch.conf
passwd: compat winbind
group: compat winbind
shadow: compat

hosts: files dns wins
networks: files dns
protocols: db files
services: db files
ethers: db files
rpc: db files

#vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
clock_skew = 300
default_realm = UBUNTU.COM
[realms]
UBUNTU.COM = {
kdc = ubuntu.com
default_domain = UBUNTU.COM
}
[domain_realm]
.kerberos.server = UBUNTU.COM
ubuntu.com = UBUNTU.COM

# kinit administrator@UBUNTU.COM
Password:
# klist
#vi /etc/samba/smb.conf
[global]
workgroup = UBUNTU
realm = UBUNTU.COM
password server = 10.10.xx.xxx
server string = Linux Web Server
security = ads
encrypt passwords = yes
log level = 3
log file = /var/log/samba/%m
max log size = 50
preferred master = No
idmap uid = 10000-20000
idmap gid = 10000-20000
winbind enum users = yes
winbind enum groups = yes
template homedir = /home/%D/%U
template shell = /bin/bash
client use spnego = yes
client ntlmv2 auth = yes
winbind separator = +
winbind refresh tickets = yes
winbind use default domain = yes
restrict anonymous = 2
guest account = nobody
socket options = TCP_NODELAY

# net ads join –U administrator@UBUNTU.COM
Password:
# /etc/init.d/winbind stop
# /etc/init.d/samba restart
# /etc/init.d/winbind start
# wbinfo –u
# wbinfo –g

samba域控配置文件nsswitch-krb5-smb.conf