From InteropWiki
My /etc/pam.d/common-account file:
account sufficient pam_winbind.so debug
account required pam_unix.so
My old /etc/pam.d/common-account file:
account optional pam_krb5.so ignore_root debug
account sufficient pam_winbind.so debug
account required pam_unix.so