[global]
   security = ADS
   kerberos method = secrets and keytab
   realm = ${REALM}
   workgroup = ${WORKGROUP}
   netbios name = ${NETBIOS_NAME}

   idmap config * : backend = tdb
   idmap config * : range = 3000-7999

   idmap config ${WORKGROUP} : backend = rid
   idmap config ${WORKGROUP} : range = 10000-999999

   winbind use default domain = yes
   winbind enum users = yes
   winbind enum groups = yes
   winbind cache time = 60

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes

   server min protocol = SMB2
   client min protocol = SMB2

   access based share enum = yes

   dedicated keytab file = /var/lib/samba/private/krb5.keytab
   kerberos encryption types = all

   load printers = no
   printcap name = /dev/null
   disable spoolss = yes

   log file = /var/log/samba/log.%m
   max log size = 10000
   logging = file
   log level = 1 auth:5 passdb:5 winbind:3

[Private]
   path = /data/private
   read only = no
   browseable = yes
   guest ok = no
   vfs objects = acl_xattr full_audit recycle
   recycle:repository = .trash/%U
   recycle:keeptree = yes
   recycle:versions = yes
   recycle:touch_mtime = yes
   recycle:directory_mode = 0700
   recycle:subdir_mode = 0700
   recycle:exclude = *.tmp,*.TMP,~$*
   recycle:exclude_dir = .trash
   veto files = /.trash/
   full_audit:prefix = %T|%u|%I|%m|%S
   full_audit:success = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:failure = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:syslog = false
   valid users = @"${DOMAIN_USERS_GROUP}"
   hide unreadable = yes
   access based share enum = yes
   ea support = yes
   nt acl support = no

[Data]
   path = /data/groups/data
   read only = no
   browseable = yes
   guest ok = no
   vfs objects = acl_xattr full_audit recycle
   recycle:repository = .trash/%U
   recycle:keeptree = yes
   recycle:versions = yes
   recycle:touch_mtime = yes
   recycle:directory_mode = 0700
   recycle:subdir_mode = 0700
   recycle:exclude = *.tmp,*.TMP,~$*
   recycle:exclude_dir = .trash
   veto files = /.trash/
   full_audit:prefix = %T|%u|%I|%m|%S
   full_audit:success = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:failure = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:syslog = false
   valid users = @"${DOMAIN_USERS_GROUP}"
   create mask = 0660
   directory mask = 2770
   force create mode = 0660
   force directory mode = 2770
   security mask = 0660
   directory security mask = 0770
   force security mode = 0660
   force directory security mode = 0770
   inherit permissions = yes
   inherit acls = yes
   inherit owner = yes
   nt acl support = no
   hide dot files = no
   hide unreadable = yes
   access based share enum = yes

[FSLogix]
   path = /data/fslogix
   read only = no
   browseable = yes
   guest ok = no
   vfs objects = acl_xattr full_audit recycle
   recycle:repository = .trash/%U
   recycle:keeptree = yes
   recycle:versions = yes
   recycle:touch_mtime = yes
   recycle:directory_mode = 0700
   recycle:subdir_mode = 0700
   recycle:exclude = *.tmp,*.TMP,~$*
   recycle:exclude_dir = .trash
   veto files = /.trash/
   full_audit:prefix = %T|%u|%I|%m|%S
   full_audit:success = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:failure = pread pread_recv read sendfile offload_read_recv pwrite pwrite_recv write recvfile offload_write_recv renameat unlinkat
   full_audit:syslog = false
   valid users = @"${FSLOGIX_GROUP}"
   force group = "${FSLOGIX_GROUP}"
   create mask = 0600
   directory mask = 0700
   force create mode = 0600
   force directory mode = 0700
   hide unreadable = yes
   access based share enum = yes