samba - Feb 2006 - how to control what users can log into the box if using ad/pam-ssh/winbindd?

Hello,
 
Well, it looks pretty cool. I can ssh in as DOMAIN+username.  I could
not find a pam_mkhomedir for aix, but I am using a preexec to make the
home directories and templates to get around that for now.  The question
is:  how do I make it so some "domain users" can login in, but other
users cannot?  I am not real familiar with ad by the way.  Do I need to
make organizational units and join that unit, or will domain users still
have access?  
 
David
 
David Shapiro
Unix Team Lead
919-765-2011