smb.conf

[global]
        security = ADS
        workgroup = EXAMPLE
        realm = EXAMPLE.LOCAL
        log file = /var/log/samba/%m.log
        log level = 1
        # Default ID mapping configuration for local BUILTIN accounts and groups on a domain member. The default (*) domain: - must not 	overlap with any domain ID mapping configuration! - must use a read-write-enabled back end,
        # such as tdb. - Adding just this is not enough - You must set a DOMAIN backend configuration, see below
        idmap config * : backend = tdb
        idmap config * : range = 3000-7999
        idmap config EXAMPLE : backend = rid
        idmap config EXAMPLE : range = 1000000 - 1999999
        winbind enum users = yes
        winbind enum groups = yes
        winbind use default domain = yes
        winbind refresh tickets = yes
        template shell = /bin/bash
        vfs objects = acl_xattr
        map acl inherit = yes
        store dos attributes = yes
        # acl allow execute always = yes

[profiles]
        comment = Users profiles
        path = /home/EXAMPLE/profiles
        browseable = Yes
        read only = No
        force create mode = 0600
        force directory mode = 0700
        csc policy = disable
        store dos attributes = yes
        vfs objects = acl_xattr