How to properly configure AD on samba?

Question

linux

Lifted the domain on a samba. Then I added one more machine in the "domain member (file server)" role. In the smb.conf configs, I wrote idmap
config * : backend = tdb
idmap config * : range = 3000-7999
idmap config SAMDOM : backend = rid
idmap config SAMDOM : range = 10000-999999
in resolve.conf
passwd = files winbind
group = files winbind
the second server of domain users sees, though why assigns uid and gid from 3000 and further (is it supposed to be?)
Then I mounted an ext4 disk with acl and created a ball there, transferred the rights to "domain admins" through windows ostnatka distributed rights to groups.
How to correctly enter a linux machine (user) into a domain? Just like the "file server" prescribes backend rid and range or just specify winbind in resolve and that's it?

Answer 1

The fact that he renumerates the UID / GID - he himself indicated in the config (idmap config range. I usually display immediately outside the local area and set 70000 - 100000)
Enter the machine into the domain - I think just like in the Windows domain - samba tries imitate Windows, so the same net ads join

Answer 2

in resolve.conf
passwd=files winbind
group=files winbind

These values ​​unless not in nsswitch.conf are specified.
Here, look how they do it, it works like clockwork for more than one year: unlis.ru/?p=501