Comment 6 for bug 1818431

About the package vs system managers debate, I'll just comment that it's not that simple, and that a package that is yet to be installed might need a service running already, and if that service failed to start, what should it do? apt stopped (it didn't "break"), so that the admin could figure out what is wrong.

Regarding the steps you took, I can't troubleshoot your deployment system, but I do see that you are starting services several times, and updating config files in between. I would suggest the following:
- install packages you need
- update config files as you need them
- join domain if needed
- then (re)start services

What you are doing, but I don't have your config files at hand to confirm, is restart the services with a configuration that is not yet valid. In particular, winbind is expecting to be joined to a domain already in the config you give it, but when it looks for the secret, it can't find it.

Perhaps another option for you is to use policy-rc.d where you can create a policy of when services should be (re)started. See the "INIT SCRIPT POLICY" section in invoke-rc.d(8) manpage, or the /usr/share/doc/init-system-helpers/README.policy-rc.d.gz file (installed by the init-system-helpers package).