anchor.diff:        };
   
         syncPasswordsByPam = mkOption {
  +        type = types.bool;
           default = false;
  -        description = "
  -          enabling this will add a line directly after pam_unix.so.
  +        description = ''
  +          Enabling this will add a line directly after pam_unix.so.
             Whenever a password is changed the samba password will be updated as well.
             However you still yave to add the samba password once using smbpasswd -a user
             If you don't want to maintain an extra pwd database you still can send plain text
             passwords which is not secure.
  -        ";
  +        '';
  +      };
  +
  +      invalidUsers = mkOption {
  +        type = types.listOf types.str;
  +        default = [ "root" ];
  +        description = ''
  +          List of users who are denied to login via Samba.
  +        '';
         };
   
         extraConfig = mkOption {
  -        # !!! Bad default.
  -        default = ''
  -          # [global] continuing global section here, section is started by nix to set pids etc
  -
  -            smb passwd file = /etc/samba/passwd
  -
  -            # is this useful ?
  -            domain master = auto
  -
  -            encrypt passwords = Yes
  -            client plaintext auth = No
  -
  -            # yes: if you use this you probably also want to enable syncPasswordsByPam
  -            # no: You can still use the pam password database. However
  -            # passwords will be sent plain text on network (discouraged)
  -
  -            workgroup = Users
  -            server string = %h
  -            comment = Samba
  -            log file = /var/log/samba/log.%m
  -            log level = 10
  -            max log size = 50000
  -            security = ${cfg.securityType}
  -
  -            client lanman auth = Yes
  -            dns proxy = no
  -            invalid users = root
  -            passdb backend = tdbsam
  -            passwd program = /usr/bin/passwd %u
  -        '';
  -
  -        description = "
  -          additional global section and extra section lines go in here.
  -        ";
  -      };
  -
  -      configFile = mkOption {
  -        description = "
  -          internal use to pass filepath to samba pam module
  -        ";
  +        type = types.lines;
  +        default = "";
  +        description = ''
  +          Additional global section and extra section lines go in here.
  +        '';
         };
   
         configText = mkOption {
           type = types.nullOr types.lines;
           default = null;
  -        description = "
  +        description = ''
             Verbatim contents of smb.conf. If null (default), use the
             autogenerated file from NixOS instead.
  -        ";
  +        '';
         };
   
         securityType = mkOption {
  -        description = "Samba security type";
  +        type = types.str;
           default = "user";
           example = "share";
  +        description = "Samba security type";
         };
   
         nsswins = mkOption {
  
positive.code: let
  
    cfg = config.services.samba;
  
    logDir = "/var/log/samba";
    privateDir = "/var/samba/private";
  
    samba = cfg.package;
  
    setupScript =
      ''
        if ! test -d /var/samba ; then
          mkdir -p /var/samba/locks /var/samba/cores/nmbd  /var/samba/cores/smbd /var/samba/cores/winbindd
        fi
  
        passwdFile="$(${pkgs.gnused}/bin/sed -n 's/^.*smb[ ]\+passwd[ ]\+file[ ]\+=[ ]\+\(.*\)/\1/p' ${configFile})"
        if [ -n "$passwdFile" ]; then
          echo 'INFO: [samba] creating directory containing passwd file'
          mkdir -p "$(dirname "$passwdFile")"
        fi
  
        mkdir -p ${logDir}
        mkdir -p ${privateDir}
      '';
  
    shareConfig = name:
  
negative.code:     services.samba = {
  
        enable = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to enable Samba, which provides file and print
            services to Windows clients through the SMB/CIFS protocol.
          '';
        };
  
        package = mkOption {
          type = types.package;
          default = pkgs.samba;
          example = pkgs.samba4;
          description = ''
  