smb.conf

[global]
    netbios name = DC
    realm = EXAMPLE.TLD
    server role = active directory domain controller
    server services = -dns
    server string = Samba4 %v AD DC
    workgroup = EXAMPLE
    idmap_ldb:use rfc2307 = yes
    ldap server require strong auth = no
    nsupdate command = /usr/bin/nsupdate -g
    interfaces = lo eth0
    wins support = yes
    server signing = mandatory
    server min protocol = SMB3
    client signing = mandatory

    # disable printing services
    printing = bsd
    printcap name = /dev/null
    load printers = no
    disable spoolss = yes

    # enable extra hashes
    password hash userPassword schemes = CryptSHA256 CryptSHA512

    # disable null session
    restrict anonymous = 2

    # disable netbios
    disable netbios = yes
    smb ports = 445

    # disable NTLMv1
    ntlm auth = mschapv2-and-ntlmv2-only

    # limit virtual ports
    rpc server dynamic port range = 50000-55000

    # ldap starttls support
    tls enabled = yes
    tls keyfile = /etc/samba/tls/dc.example.tld.key
    tls certfile = /etc/samba/tls/dc.example.tld.crt
    tls cafile = /etc/samba/tls/example_CA.crt

    # enable audit log
    log level = 1 auth_json_audit:3@/var/log/samba/samba_audit.log

    # sysvol write log
    full_audit:failure = none
    full_audit:success = pwrite write rename
    full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
    full_audit:facility = local7
    full_audit:priority = NOTICE

[netlogon]
    path = /var/lib/samba/sysvol/example.tld/scripts
    read only = No
    create mask = 0700
    directory mask = 0644
    vfs objects = dfs_samba4, acl_xattr, full_audit

[sysvol]
    path = /var/lib/samba/sysvol
    read only = No
    create mask = 0700
    directory mask = 0644
    vfs objects = dfs_samba4, acl_xattr, full_audit