ansible_samba_domain_member/templates/smb.conf.j2

[global]
   workgroup = {{ ad_realm.split('.')[0] }}
   security = ads
   realm = {{ ad_realm }}

   # users will be in the form username instead of DOMAIN\username.
   winbind use default domain = true
   
   winbind offline logon = false
   dedicated keytab file = /etc/krb5.keytab
   kerberos method = secrets and keytab
   
   # Default ID mapping configuration for local BUILTIN accounts
   # and groups on a domain member. The default (*) domain:
   # - must not overlap with any domain ID mapping configuration!
   # - must use a read-write-enabled back end, such as tdb.
   idmap config * : backend = tdb
   idmap config * : range = 3000-7999

   # - You must set a DOMAIN backend configuration
   # idmap config for the {{ ad_realm.split('.')[0] }} domain
   idmap config {{ ad_realm.split('.')[0] }} : backend = rid
   idmap config {{ ad_realm.split('.')[0] }} : range = 10000-999999

   # Template settings for login shell and home directory
   template shell = /bin/bash
   template homedir = /home/%U