In extra options set this
security = ads
kerberos method = secrets and keytab
realm = EXAMPLE.COM
winbind enum users = yes
winbind enum groups = yes
# Default ID mapping configuration using the rid
# idmap backend. This will work out of the box for simple setups
# as well as complex setups with trusted domains.
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config EXAMPLE : backend = rid
idmap config EXAMPLE : range = 10000-9999999
winbind use default domain = yes