This option is deprecated with Samba 4.8 and will be removed in future. At the same time the default changed to yes, which will be the hardcoded behavior in future. This controls whether the client offers or even demands the use of the netlogon schannel. no does not offer the schannel, auto offers the schannel but does not enforce it, and yes denies access if the server is not able to speak netlogon schannel. Note that for active directory domains this is hardcoded to yes. This option is over-ridden by the option. yes auto