$ grep -Ev '^#|^;|^[     ]*$' /usr/local/etc/smb.conf
[global]
   workgroup = DOMAIN
   netbios name = GW
   message command = /bin/sh -c '/root/bin/winpopup.sh %s %f %m' &
   time server = True
   server string = GateWay
   security = ads
   auth methods = winbind
   hosts allow = 10.0.0.0/24 127.0.0.1
   load printers = no
   log file = /var/log/samba/log.%m
   max log size = 50
   log level = 2
   password server = 10.0.0.3
   encrypt passwords = yes
   nt acl support = Yes
   name resolve order = wins host bcast lmhosts
   guest ok = No
   realm = DOMAIN.LOCAL
   socket options = TCP_NODELAY
   interfaces = 10.0.0.1 127.0.0.1
   bind interfaces only = yes
   local master = no
   os level = 0
   domain master = no
   preferred master = no
   domain logons = no
   wins support = no
   wins server = 10.0.0.3
   dns proxy = no
   display charset = koi8-r
   unix charset = koi8-r
   dos charset = cp866
#делал по разному: и "+" и "\" и вообще убирал параметр
   winbind separator = \
   winbind use default domain = yes
   winbind uid = 10000-20000
   winbind gid = 10000-20000
   winbind enum users = yes
   winbind enum groups = yes
[pub]
   path = /pub
   browseable = no
   writable = yes
   guest ok = no
   public = no
   printable = no
   valid users = DOMAIN\user1 DOMAIN\user2 DOMAIN\user3 DOMAIN\COMPUTER$ user1 user2 user3 COMPUTER$
   force user = existing_local_user

$ cat /etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
[realms]
DOMAIN.LOCAL = {
        kdc = server.domain.local
        admin_server = server.domain.local
}
#server.domain.local - win2k domain controller

Что лучше оставить в winbind separator и в valid users?