diff --git a/etc/sssd/sssd.conf b/etc/sssd/sssd.conf
index 43633ff..4efa46b 100644
--- a/etc/sssd/sssd.conf
+++ b/etc/sssd/sssd.conf
@@ -6,12 +6,14 @@ domains = ad.francetelecom.fr
 certificate_verification = no_ocsp
 services = nss
 
+
 [nss]
 filter_users = root
 filter_groups = root
 
+
 [pam]
-pam_verbosity = 3
+pam_verbosity = 2
 pam_account_expired_message = Account expired, please contact help desk.
 pam_account_locked_message = Account locked, please contact help desk
 pam_public_domains = ad.francetelecom.fr
@@ -19,19 +21,26 @@ pam_cert_auth = false
 p11_child_timeout = 60
 offline_credentials_expiration = 0
 
+
 [domain/ad.francetelecom.fr]
-min_id = 1000
 id_provider = files
+min_id = 1000
+max_id = 60000
+#
 auth_provider = krb5
-chpass_provider = none
-cache_credentials = true
-use_fully_qualified_names = false
 krb5_realm = AD.FRANCETELECOM.FR
 krb5_auth_timeout = 10
 krb5_store_password_if_offline = true
 krb5_lifetime = 24h
 krb5_renewable_lifetime = 7d
 krb5_renew_interval = 30m
-# see /etc/krb5.conf
-krb5_use_kdcinfo = false
+krb5_use_kdcinfo = true
+krb5_kdcinfo_lookahead = 5:2
+dns_discovery_domain = S-FT-FR-EBU._sites.ad.francetelecom.fr
+#
+chpass_provider = none
+#
+cache_credentials = true
+use_fully_qualified_names = false
+lookup_family_order = ipv4_only