My first experience with SSSD for SFTP authentication was having a higly critical system's authentication going off because I didn't know about adcli, so I didn't install it. After exactly 30 days, the AD server changed that machine account's password, but the linux server didn't. Those were rough days. So, I'm pretty sure that updating the machine account's password is a must unless you disable password age on your AD domain:
Regarding the smb.conf, for some reason I never got "kerberos method = system keytab" to work. I had to set either "kerberos method = dedicated keytab"or "kerberos method = secrets and keytab" along with the keytab's path.
Looks like samba can't find the "system tab", even though it's in /etc/krb5.keytab.
I will consider this set up and let you know if I ever get it working.