samba - Mar 2026 - samba-ad-dc: are pam/nss-winbind, and winbind itself, needed for AD-DC functionality?

Hi!

Are the mentioned components actually needed on an Active-Directory
Domain Controller?

In Debian Samba packaging, I've made these as dependencies for the samba
domain controller.  But now I wonder if it was the correct decision.

See https://bugs.debian.org/1130068 for a debian bug report about this.

It looks like pam and nss are not needed at all.

As for winbind, apparently it *is* started by samba.  But even there,
I'm not sure it's actually needed for the AD-DC itself - it looks like
I can drop it from `server services` setting.

BTW, where one can find documentation about various server services,
what are they, what they're used for, etc?

Thanks,

/mjt

On Sun, 8 Mar 2026 13:19:28 +0300
Michael Tokarev via samba <samba at lists.samba.org> wrote:
> Hi!
> 
> Are the mentioned components actually needed on an Active-Directory
> Domain Controller?
> 
> In Debian Samba packaging, I've made these as dependencies for the
> samba domain controller.  But now I wonder if it was the correct
> decision.
> 
> See https://bugs.debian.org/1130068 for a debian bug report about
> this.
> 
> It looks like pam and nss are not needed at all.
> 
> As for winbind, apparently it *is* started by samba.  But even there,
> I'm not sure it's actually needed for the AD-DC itself - it looks
like
> I can drop it from `server services` setting.
> 
> BTW, where one can find documentation about various server services,
> what are they, what they're used for, etc?
> 
> Thanks,
> 
> /mjt
> 
This is my understanding of the relationship between winbindd and
Samba. 

The winbindd daemon is required by Samba to be able to 'talk' to AD,
whether this is a DC or Unix domain member.

The two packages 'libpam-winbind' & 'libnss-winbind' are the
'glue'
between Samba and nsswitch and they are only required on a DC if you
want your users to log onto the Samba AD DC and, as Samba does not
recommend using a DC as a fileserver, they are really not required.
If the two packages are not installed, while Samba will know who your
users are, they will be unknown to the Unix host and will not be able
to logon to the host, or save files.

Rowland