Deactivate user access to SAMBA file server in LDAP while maintaining access to other services

Question

I am trying to cut off access of an ldap user to samba server. Disabling password is not an option, since the user needs to maintain access to other services like Nextcloud which is connected to the same ldap directory. How would I achieve this?

This is how my ldap directory for this user looks like:

Answer 1

From man smb.conf:

invalid users (S)
  This is a list of users that should not be allowed to login to this
  service. This is really a paranoid check to absolutely ensure an
   improper setting does not breach your security.

You can use the invalid user directive to prohibit a single user.