cat /etc/samba/smb.conf

[global]
security = ADS
workgroup = EXAMPLE
realm = EXAMPLE.CORP

username map = /etc/samba/user.map

log file = /var/log/samba/%m.log
log level = 0

allow trusted domains = no

dns proxy = no
domain master = no
local master = no
preferred master = no
os level = 0
domain logons = no

# Disable printing completely
load printers = no
printing = bsd
show add printer wizard = no
printcap name = /dev/null
disable spoolss = yes

map to guest = bad user
host msdfs = no
ea support = yes

unix charset = UTF-8

winbind enum groups = yes
winbind enum users = yes
#winbind enum groups = no
#winbind enum users = no
winbind use default domain = yes
#winbind use default domain = no
winbind refresh tickets = yes
winbind offline logon = yes
winbind nested groups = yes
winbind expand groups = 5
winbind max domain connections = 30
winbind scan trusted domains = no


kerberos method = system keytab
dedicated keytab file = /etc/krb5.keytab

# disable usershares creating, when set empty no error log messages.
usershare path =

idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config EXAMPLE : backend = rid
idmap config EXAMPLE : range = 10000-999999


vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes

access based share enum = yes
# hide files start with a dot (.)
hide dot files = no
# hide files with no read permissions
hide unreadable = yes
# hide files with no write permissions
hide unwriteable files = yes
# hide selected files. example files start with ($)
#hide files = //
# hide pipes, sockets, devices ...
#hide special files = yes
hide files = /lost+found/
#veto files = /lost+found/

acl group control = yes
acl map full control = Yes
#enable privileges = yes
restrict anonymous = 2

disable netbios = yes
smb ports = 445
interfaces = lo ens18
bind interfaces only = yes

# pam
template shell = /bin/bash
template homedir = /home/%D/%U
#template homedir = /dev/null
#template shell = /bin/false

[videoreg]
#browseable = yes
path = /data/videoreg
read only = no


disable netbios = yes
smb ports = 445
interfaces = lo ens18
bind interfaces only = yes

# pam
template shell = /bin/bash
template homedir = /home/%D/%U
#template homedir = /dev/null
#template shell = /bin/false

[videoreg]
#browseable = yes
path = /data/videoreg
read only = no

cat /etc/samba/user.map
!root = EXAMPLE\admin

firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports: 445/tcp 10050/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

cat /etc/krb5.conf
[libdefaults]
default_realm = EXAMPLE.CORP
dns_lookup_realm = false
dns_lookup_kdc = true