IT ...

I followed this link exactly, just one more line to add,

local master = no

Or else, the master (AD) will always be bugged with MRxSmb, Event ID 8003.

This is my first time to configure kerberos also.