14.4.4. Active Directory Security Mode (User-Level Security)

If you have an Active Directory environment, it is possible to join the domain as a native Active Directory member. Even if a security policy restricts the use of NT-compatible authentication protocols, the Samba server can join an ADS using Kerberos. Samba in Active Directory member mode can accept Kerberos tickets.

In smb.conf, the following directives make Samba an Active Directory member server:

[GLOBAL]
...
security = ADS
realm = EXAMPLE.COM
password server = kerberos.example.com 
...

[GLOBAL]
...
security = ADS
realm = EXAMPLE.COM
password server = kerberos.example.com 
...