Make sure winbindd is using only DNS to resolve Active Directory domain controllers.
In install/share/smb.conf.registry.template, make sure to add:
install/share/smb.conf.registry.template
[global] ... name resolve order = host
We don't want winbindd to resolve anything but domain controllers and these should be resolved through DNS anyway via SRV records.
winbindd
I recently tried to establish trust with Windows Server 2025-based Active Directory deployment and even without this option we had not been using ports 138 and 139, so we should be ok, but this will allow winbindd to fail over faster and make sure to see potential problems in the logs.
Same for ipa-client-samba which has embedded smb.conf template in ipaclient/install/ipa_client_samba.py
ipa-client-samba
ipaclient/install/ipa_client_samba.py
There are also messages about NetBIOS ports in ipa-adtrust-install.