我有一个centos 8 linux文件服务器，使用sssd/realm连接到windows ad。我可以确认我可以使用windows AD creds登录它。
现在，我想更进一步，使用Windows AD组在我装载的文件共享上给予RO/RW权限。
我已经达到了一个点，那里的网络访问，我可以访问共享从windows设备和r/W上。问题是当我试图配置任何种类的组权限。当我尝试登录creds输入窗口弹出，我输入creds和我得到拒绝访问错误。
除了使用realm将机器加入AD之外，我没有在smb.conf文件之外做其他配置，我将在这里附上该文件。
配置如下：

## Browsing/Identification ###

# Change this to the workgroup/NT-domain name your Samba server will part of
        workgroup = workgroup
        security = user
        passdb backend = tdbsam
        encrypt passwords = yes
        realm = domain.de
        server min protocol = SMB2_10
        client max protocol = SMB3
        client min protocol = SMB2_10

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
  interfaces = 127.0.0.0/8 192.168.30.65/24 192.168.20.65/24
#  interfaces = 127.0.0.0/8 192.168.30.98/24

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
  bind interfaces only = yes


#### Debugging/Accounting ####

# This tells Samba to use a separate log file for each machine
# that connects
   log file = /var/log/samba/log.%m

# Cap the size of the individual log files (in KiB).
   max log size = 1000

# Append syslog@1 if you want important messages to be sent to syslog too.

   logging = file

# Do something sensible when Samba crashes: mail the admin a backtrace
   panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# Server role. Defines in which mode Samba will operate. Possible
# values are "standalone server", "member server", "classic primary
# domain controller", "classic backup domain controller", "active
# directory domain controller".
#
# Most people will want "standalone server" or "member server".
# Running as "active directory domain controller" will require first
# running "samba-tool domain provision" to wipe databases and create a
# new domain.
   server role = standalone server

   obey pam restrictions = yes

# This boolean parameter controls whether Samba attempts to sync the Unix
# password with the SMB password when the encrypted SMB password in the
# passdb is changed.
   unix password sync = yes

# For Unix password sync to work on a Debian GNU/Linux system, the following
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
# sending the correct chat script for the passwd program in Debian Sarge).

   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
   pam password change = yes

# This option controls how unsuccessful authentication attempts are mapped
# to anonymous connections
   map to guest = bad user

#[videoarchiv]
#   path = /mnt/video_archiv
#   available = yes
#   browsable = yes
#   public = yes
#   writable = yes
#   guest ok = yes
#   create mode = 0777
#   directory mode = 0777
   #force user = samba-public

[bilder]
   path = /mnt/bilder_archiv
   available = yes
   browsable = yes
   public = yes
   writable = yes
   valid users = @"smbRW"
   #write list = u/smbRW
   guest ok = yes
   create mode = 2777
   directory mode = 2777
   #force user = samba-public

除了这个conf文件之外，我唯一做的更改是将整个目录的组所有权设置为root：nobody
我现在没有任何人，所以我可以测试访问，但我假设我最终需要更改它？
除此之外，我知道我没有在任何地方配置写权限，我只想在这一点上，这是我挣扎的重点与AD的身份验证。
任何帮助管理这将是非常感谢
我一整天都在努力实现这一点，但没有结果。似乎网上的一切都说了一些略有不同的东西。
尝试了许多不同的配置方式。
期望从Windows客户端无缝访问共享，并根据用户的Windows AD组获取权限。