obey pam restrictions (G) When Samba 2.2 is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAM's account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of encrypt passwords = yes . The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. Default: obey pam restrictions = no