jra@ gave his blessing for the following conf files:

smb.conf:
    [global]
        netbios name = <machine name>
        security = ADS
        workgroup = <workgroup name>
        realm = <realm>
        lock directory = /tmp/authpolicyd/samba/lock
        cache directory = /tmp/authpolicyd/samba/cache
        state directory = /tmp/authpolicyd/samba/state
        private directory = /tmp/authpolicyd/samba/private
        kerberos method = secrets and keytab
        client signing = mandatory
        client min protocol = SMB2
        client max protocol = SMB3
        client ipc min protocol = SMB2
        client schannel = yes
        client ldap sasl wrapping = sign

krb5.conf:
    [libdefaults]
        default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
        default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
        permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
        allow_weak_crypto = false
        clockskew = 300
        default_realm = <realm>

I believe you added one more config option since this was filed?

Correct. 'kerberos encryption types = strong' was added:

smb.conf:
    [global]
        netbios name = <machine name>
        security = ADS
        workgroup = <workgroup name>
        realm = <realm>
        lock directory = /tmp/authpolicyd/samba/lock
        cache directory = /tmp/authpolicyd/samba/cache
        state directory = /tmp/authpolicyd/samba/state
        private directory = /tmp/authpolicyd/samba/private
        kerberos method = secrets and keytab
        kerberos encryption types = strong
        client signing = mandatory
        client min protocol = SMB2
        client max protocol = SMB3
        client ipc min protocol = SMB2
        client schannel = yes
        client ldap sasl wrapping = sign

Jorge flipped the security bit.

bulk Verify of Chromad V1 bugs