В общем самба поставилась нормально и в домен ввелась. керберос билеты получает без проблем. Но вот к шарам доступа нет и система не видит доменных пользователей.
Структура домена не простая, есть два дочерних домена.

id vasya выдает 
id: vasya: no such user

wbinfo -u выдает пользователей одного из дочерних доменов. Судя по всему последнего по алфавиту. никаких ошибок нигде нет.

net ads user -U domainadmin

нормально выдает список пользователей. Ошибок тоже нигде никаких нет.

getent passwd выдает только пользователей самой фри.
уже голову сломал что может быть. Помогите если кто сталкивался. В чем может быть проблема. Вот собственно конфиги.

krb5.conf

[appdefaults]
        forwardable     =       true
        proxiable       =       true
        ticket_lifetime =       24h
        renew_lifetime  =       24h
[libdefaults]
        default_realm   =       PROC.LOCAL
        default_etypes  =       des-cbc-crc des-cbc-md5 des-cbc-md4 des3-cbc-sha1 arcfour-hmac-md5 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
        default_etypes_des =    des-cbc-crc des-cbc-md5 des-cbc-md4 des3-cbc-sha1 arcfour-hmac-md5 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
        dns_lookup_kdc  =       true
        dns_lookup_realm=       false
        krb4_get_tickets=       false
[domain_realm]
        .proc.local     =       PROC.LOCAL
        proc.local      =       PROC.LOCAL
[realms]
        PROC.LOCAL      =       {
        kdc             =       tcp/lawnew.proc.local:88 tcp/procpdc.proc.local:88
        admin_server    =       lawnew.proc.local
        }
[kdc]
        enable-kerberos4=       false

smb.conf

[global]
        dos charset = cp866
        unix charset = koi8-r
        display charset = koi8-r
        workgroup = PROC
        realm = PROC.LOCAL
        server string = Samba Server NETSVR
        interfaces = 192.168.1.1/23
        security = ADS
        auth methods = winbind
        password server = lawnew.proc.local procpdc.proc.local
        log level = 0 vfs:1
        log file = /var/log/samba/log.%m
        max log size = 50000
        os level = 33
        preferred master = Yes
        local master = No
        domain master = Yes
        dns proxy = No
        wins server = 192.168.1.251
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind refresh tickets = Yes
        inherit acls = Yes
        hosts allow = 192.168.0.0/23, 127.
        map acl inherit = Yes
        case sensitive = No
[ITO]
        comment = Home Directories
        path = /data/ito
        admin users = PROC\komal
        read only = No
        create mask = 0777
        directory mask = 0777
        inherit permissions = Yes
        inherit owner = Yes
        vfs objects = recycle, full_audit
        recycle:versions = yes
        recycle:keeptree = yes
        recycle:maxsize = 104851000
        recycle:exclude = *.tmp | *.TMP | ~$*
        recycle:repository = /data/recycles
        full_audit:priority = INFO
        full_audit:facility = LOCAL5
        full_audit:failure = write rename unlink mkdir rmdir
        full_audit:success = write rename unlink mkdir rmdir
        full_audit:prefix = %m|%U
[webdata]
        comment = Home Directories
        path = /usr/local/www
        admin users = PROC\komal
        read only = No
        create mask = 0777
        directory mask = 0777
        inherit permissions = Yes
        inherit owner = Yes
        vfs objects = recycle, full_audit
        recycle:versions = yes
        recycle:keeptree = yes
        recycle:maxsize = 104851000
        recycle:exclude = *.tmp | *.TMP | ~$*
        recycle:repository = /usr/usrdata/recycles
        full_audit:priority = INFO
        full_audit:facility = LOCAL5
        full_audit:failure = write rename unlink mkdir rmdir
        full_audit:success = write rename unlink mkdir rmdir
        full_audit:prefix = %m|%U
[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        browseable = No

nsswitch.conf

group: files winbind
group_compat: nis
hosts: files dns winbind
networks: files
passwd: files winbind
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

все имена контроллеров доменов разрешаются нормально.