Per a recent discussion on the samba mailing list, I'd like to see a required-membership-of pam_winbind option implemented: See: http://lists.samba.org/archive/samba/2005-May/105814.html
Nevermind... it seems aready implemented (I missed the pam_winbind manpage).
the man page is wrong. This option was never completed in the pam_winbind source.
The option is actually implemented, although that was not so evident in the source-code. Closing this bug, the feature is supposed to exist and work, please reopen if you see any problems with it.
sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.