Debian - Offline-Anmeldung von AD-Benutzer scheitert

[global]
debug=yes
#debug_state = yes
krb5_auth=yes
krb5_ccache_type=FILE
cached_login=yes

[global]
security = ads
realm = ADDOMAIN.TLD
workgroup = ADDOMAIN
netbios name = AP201N

log file = /var/log/samba/log.%m
max log size = 1000
server role = member server
server min protocol = SMB2_10
server max protocol = SMB3_11
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .

idmap config * : backend = tdb
idmap config * : range = 3000-7999

idmap config ADDOMAIN : backend = ad
idmap config ADDOMAIN : schema_mode = rfc2307
idmap config ADDOMAIN : range = 10000-999999
idmap config ADDOMAIN : unix_nss_info = yes
idmap config ADDOMAIN : unix_primary_group = yes

winbind enum users = yes
winbind enum groups = yes
winbind cache time = 10
winbind use default domain = yes
winbind refresh tickets = yes

winbind offline logon = yes
lock directory = /var/cache/samba
#winbind nested groups = yes

template homedir = /home/%D/%U
template shell = /bin/bash
client signing = yes
#client use spnego = yes
#client ntlmv2 auth = yes
#encrypt passwords = yes
restrict anonymous = 2
domain master = no
local master = no
preferred master = no
os level = 0
kerberos method = secrets and keytab

vfs objects = acl_xattr
map acl inherit = yes

[logging]
default = FILE:/var/log/krb5.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
clock_skew = 300
default_realm = ADDOMAIN.TLD
dns_lookup_realm = false
dns_lookup_kdc = true

[realms]
    ADDOMAIN.TLD = {
	kdc = dc1.addomain.tld:88
	kdc = dc2.addomain.tld:88
	admin_server = dc1.addomain.tld:464
	default_domain = ADDOMAIN.TLD
	auth_to_local = RULE:[1:$1@$0]
    }

[domain_realm]
    .addomain.tld = ADDOMAIN.TLD
    addomain.tld = ADDOMAIN.TLD

passwd:         files winbind
group:          files winbind
shadow:         files sss
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
sudoers:        files

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)  
auth	[success=4 default=ignore]	pam_krb5.so minimum_uid=1000
auth	[success=3 default=ignore]	pam_unix.so nullok try_first_pass
auth	[success=2 default=ignore]	pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth	[success=1 default=ignore]	pam_sss.so use_first_pass
# here's the fallback if no module succeeds  
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;  
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)  
# end of pam-auth-update config

lightdm: pam_winbind(ligthdm:auth): PAM config: krb5_cache_type 'KEYRING'  
lightdm: pam_winbind(ligthdm:auth): [pamh: 0x...] LEAVE: pam_sm_authenticate returning 10 (PAM_USER_UNKNOW)

[2022/06/05 10:50:09.374131,  0] ../../source3/winbindd/winbindd.c:247(winbindd_sig_term_handler)
  Got sig[15] terminate (is_parent=0)
[2022/06/05 10:51:35.732087,  0] ../../source3/winbindd/winbindd_cm.c:1873(wb_open_internal_pipe)
  open_internal_pipe: Could not connect to dssetup pipe: NT_STATUS_RPC_INTERFACE_NOT_FOUND
[2022/06/05 10:51:35.736282,  0] ../../source3/rpc_server/rpc_ncacn_np.c:454(rpcint_dispatch)
  rpcint_dispatch: DCE/RPC fault in call lsarpc:2E - DCERPC_NCA_S_OP_RNG_ERROR

[2022/06/05 10:50:09.361021,  0] ../../source3/winbindd/winbindd.c:247(winbindd_sig_term_handler)
  Got sig[15] terminate (is_parent=1)
[2022/06/05 10:51:35.696066,  0] ../../source3/winbindd/winbindd.c:1773(main)
  winbindd version 4.13.13-Debian started.
  Copyright Andrew Tridgell and the Samba Team 1992-2020
[2022/06/05 10:51:35.725952,  0] ../../lib/util/become_daemon.c:135(daemon_ready)
  daemon_ready: daemon 'winbindd' finished starting up and ready to serve connections  

[2022/06/05 10:50:09.372280,  0] ../../source3/winbindd/winbindd.c:247(winbindd_sig_term_handler)
  Got sig[15] terminate (is_parent=0)

[2022/06/05 10:50:09.375867,  0] ../../source3/winbindd/winbindd.c:247(winbindd_sig_term_handler)
  Got sig[15] terminate (is_parent=0)

[2022/06/05 10:51:35.824928,  0] ../../source3/smbd/server.c:1784(main)
  smbd version 4.13.13-Debian started.
  Copyright Andrew Tridgell and the Samba Team 1992-2020
[2022/06/05 10:51:35.884461,  0] ../../lib/util/become_daemon.c:135(daemon_ready)
  daemon_ready: daemon 'smbd' finished starting up and ready to serve connections  
[2022/06/05 10:51:35.888463,  0] ../../source3/printing/nt_printing.c:252(nt_printing_init)
  nt_printing_init: error checking published printers: WERR_ACCESS_DENIED

[2022/06/05 10:51:15.534224,  0] ../../source3/nmbd/nmbd.c:960(main)
  nmbd version 4.13.13-Debian started.
  Copyright Andrew Tridgell and the Samba Team 1992-2020
[2022/06/05 10:51:15.539560,  0] ../../lib/util/become_daemon.c:147(daemon_status)
  daemon_status: daemon 'nmbd' : No local IPv4 non-loopback interfaces available, waiting for interface ...  
[2022/06/05 10:51:15.539628,  0] ../../source3/nmbd/nmbd_subnetdb.c:253(create_subnets)
  NOTE: NetBIOS name resolution is not supported for Internet Protocol Version 6 (IPv6).