# explicitely use eth0 and set static IPs, as well as domain specifics
interface eth0
static routers=192.168.1.1
static domain_name_servers=127.0.0.1
static domain_name_servers=192.168.1.1
static ip_address=192.168.1.2
static domain_search=my.domain.local

apt-get install samba smbclient winbind krb5-user krb5-config krb5-locales winbind libpam-winbind libnss-winbind samba-dsdb-modules samba-vfs-modules bind9 dnsutils

systemctl stop samba-ad-dc.service smbd nmbd winbind
systemctl disable samba-ad-dc.service smbd nmbd winbind

mv /etc/samba/smb.conf /etc/samba/smb.conf.backup
rm /etc/krb5.conf

# smbd -b | egrep "LOCKDIR|STATEDIR|CACHEDIR|PRIVATE_DIR"
  LOCKDIR: /usr/local/samba/var/lock/
  STATEDIR: /usr/local/samba/var/locks/
  CACHEDIR: /usr/local/samba/var/cache/
  PRIVATE_DIR: /usr/local/samba/private/

samba-tool domain provision --dns-backend "BIND9_DLZ" --use-rfc2307 --interactive

ln -sf /var/lib/samba/private/krb5.conf /etc/krb5.conf

systemctl unmask samba-ad-dc
systemctl status samba-ad-dc
systemctl enable samba-ad-dc
systemctl status samba-ad-dc
systemctl start samba-ad-dc

search my.domain.local
nameserver 192.168.1.2

chattr +i /etc/resolv.conf

[libdefaults]
        default_realm = DOMAIN.LOCAL
        dns_lookup_realm = false
        dns_lookup_kdc = true
[realms]
    DOMAIN.LOCAL = {
        kdc = 192.168.1.2
    }

[global]
        dns forwarder = 192.168.1.2
        netbios name = DC
        realm = DOMAIN.LOCAL
        server role = active directory domain controller
        server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
        workgroup = DOMAIN
        idmap_ldb:use rfc2307 = yes
        kerberos method = system keytab
        client ldap sasl wrapping = sign
        allow dns updates = nonsecure and secure
        nsupdate command =  /usr/bin/nsupdate -g
        local master = yes
        os level = 255
        preferred master = yes
        log level = 3
        username map = /etc/samba/username.map
[netlogon]
        path = /var/lib/samba/sysvol/domain.local/scripts
        read only = No
[sysvol]
        path = /var/lib/samba/sysvol
        read only = No

root=DOMAIN\Administrator

// include Active Directory support
include "/var/lib/samba/bind-dns/named.conf";
include "/etc/bind/rndc.key";

kinit Administrator@DOMAIN.LOCAL
dig -t axfr domain.local