diff --git a/roles/domain/templates/smb.conf b/roles/domain/templates/smb.conf
index 2eabbca..254ac6d 100644
--- a/roles/domain/templates/smb.conf
+++ b/roles/domain/templates/smb.conf
@@ -6,13 +6,11 @@
   workgroup = {{ ansible_local.domain.domainshort }}
   idmap uid = 10000000-19999999
   idmap gid = 10000000-19999999
+  winbind enum users = yes
+  winbind enum groups = yes
   winbind use default domain = yes
-  winbind enum users = no
-  winbind enum groups = no
-  winbind use default domain = yes
+  winbind expand groups = 1
   template shell = /bin/bash
   template homedir = /home/%D/%U
   domain master = no
-  winbind enum users = yes
-  winbind enum groups = yes
   add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u