4GB RAM, 2CPU
smbd, nmbd, winbind, squid, sshd. No other services.

Samba: domain member
Server time offset: 0

---------------------------------

The DNS is on the same server as is AD.
Time to resolve the AD server:
real    0m0.026s
user    0m0.019s
sys     0m0.005s

----------------------------------

time getent group userw01
userw01:x:3000968:userw01

real    0m0.036s
user    0m0.000s
sys     0m0.004s

----------------------------------

time net ads testjoin
Join is OK

real    0m1.058s
user    0m0.152s
sys     0m0.033s

-----------------------------------

## time wbinfo -r userw01
3000968
.....
3000965

real    0m0.053s
user    0m0.007s
sys     0m0.007s

------------------------------------

### /etc/nsswitch.conf
passwd:         files winbind
group:          files winbind
shadow:         files
#passwd:         files systemd
#group:          files systemd
#shadow:         files
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

-------------------------------------

### smb.conf
# Global parameters
[global]
        #dns forwarder = 2.3.4.5
        netbios name = ABC123
        passdb backend = samba_dsdb
        realm = DOM1.COM
        server role = member server
        workgroup = DOM1
        log level = 0
        security = ads
        os level = 0
        template shell = /usr/bin/bash
        directory mask = 0755
        create mask = 0644
        encrypt passwords = Yes
        idmap config * : backend = tdb
        idmap config * : range = 1000000-2139999999
        idmap config ad001 : backend = rid
        idmap config ad001 : range = 2140000000-4290000000
        password server = *
        client NTLMv2 auth = Yes
        client max protocol = SMB3
        winbind use default domain = Yes
        winbind rpc only = Yes
        create krb5 conf = No