[global]

# workgroup = NT-Domain-Name or Workgroup-Name
workgroup = domain

# this tells Samba to use a separate log file for each machine that connects
log file = /var/log/samba/log.%m

# Put a capping on the size of the log files (in Kb).
max log size = 50

# Set the log (verbosity) level (0 <= log level <= 10)
; log level = 3

# Most people will find that this option gives better performance.
# See speed.txt and the manual pages for details
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

# On installation the following message appeared in the logs
# 	when running `wbinfo -u`:

#  winbindd version 3.0.14a started.
#  Copyright The Samba Team 2000-2004
# [2005/12/11 16:02:43, 0] nsswitch/winbindd_cm.c:cm_get_sam_handle(1027)
#  samr_connect() received NT_STATUS_ACCESS_DENIED.  If you are connecting 
#  to a Windows 2003 SP1 DC, this is a known issue.  There are two current 
#  workarounds:
#  (a) Move your configuration to security = ads, or
#  (b) set 'client schannel = no' in smb.conf and use 'wbinfo --set-auth-user'
#      to define the credentials when connecting to the DC

# The following fix worked:
client schannel = no

# Security mode. Most people will want user level security. See
# security_level.txt for details.
#   security = user
security = domain

# Use password server option only with security = server or security = domain
# When using security = domain, you should use password server = *
;   password server = <NT-Server-Name>
;   password server = *
password server = *

encrypt passwords = yes

# Options for using winbind. Winbind allows you to do all account and
# authentication from a Windows or samba domain controller, creating
# accounts on the fly, and maintaining a mapping of Windows RIDs to unix uid's 
# and gid's. idmap uid and idmap gid are the only required parameters.
#
# winbind separator is the character a user must use between their domain
# name and username, defaults to "\"
;  winbind separator = +
#
# winbind use default domain allows you to have winbind return usernames
# in the form user instead of DOMAIN+user for the domain listed in the
# workgroup parameter.
;  winbind use default domain = yes
winbind use default domain = yes

# When using winbind, you may want to have samba create home directories
# on the fly for authenticated users. Ensure that /etc/pam.d/samba is
# using 'service=system-auth-winbind' in pam_stack modules, and then
# enable obedience of pam restrictions below:
;  obey pam restrictions = yes

# use uids from 10000 to 20000 for domain users
idmap uid = 10000-20000
# use gids from 10000 to 20000 for domain groups
idmap gid = 10000-20000

# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes

# set local master to no if you don't want Samba to become a master
# browser on your network. Otherwise the normal election rules apply
;   local master = no
local master = no

# Domain Master specifies Samba to be the Domain Master Browser. This
# allows Samba to collate browse lists between subnets. Don't use this
# if you already have a Windows NT domain controller doing this job
;   domain master = yes
domain master = no


obey pam restrictions = yes

# All NetBIOS names must be resolved to IP Addresses
# 'Name Resolve Order' allows the named resolution mechanism to be specified
# the default order is "host lmhosts wins bcast". "host" means use the unix
# system gethostbyname() function call that will use either /etc/hosts OR
# DNS or NIS depending on the settings of /etc/host.config, /etc/nsswitch.conf
# and the /etc/resolv.conf file. "host" therefore is system configuration
# dependant. This parameter is most often of use to prevent DNS lookups
# in order to resolve NetBIOS names to IP Addresses. Use with care!
# The example below excludes use of name resolution for machines that are NOT
# on the local network segment
# - OR - are not deliberately to be known via lmhosts or via WINS.
; name resolve order = wins lmhosts bcast

# WINS Server - Tells the NMBD components of Samba to be a WINS Client
#       Note: Samba can be either a WINS Server, or a WINS Client, but NOT both
;   wins server = w.x.y.z
wins server = 192.168.0.201


