The samba mailing list says this problem is -not- a samba problem.
It was recommended I change my smb.conf to:
[global]
workgroup = CORP
realm =
CORP.CELADONSYSTEMS.COM
server string = samba-2
security = ADS
kerberos method = secrets and keytab
log file = /var/log/samba/%m.log
logon script = %U.bat
restrict anonymous = 2
load printers = no
The samba logs indicate the problem is with samba.
The sssd logs show everything working except for samba (like I can ssh as AD DC users).
With max debug on for sssd I do not see samba even using sssd for authentication
information.
Maybe a permissions problem on the AD DC? Although I can auth via ssh?
Can you recommend web links on confirming permissions are appropriate on the AD DC?