--- a/service/realmd-altlinux-helper
+++ b/service/realmd-altlinux-helper
@@ -13,6 +13,18 @@
     return $RETVAL
 }
 
+change_winbind_nsswitch()
+{
+    sed -E 's/(passwd:.*) winbind/\1/; s/(passwd:.*)/\1 winbind/;' -i /etc/nsswitch.conf || return
+    sed -E 's/(group:.*) winbind/\1/; s/(group:.*)/\1 winbind/;' -i /etc/nsswitch.conf
+}
+
+rollback_winbind_nsswitch()
+{
+    sed -E 's/(passwd:.*) winbind/\1/;' -i /etc/nsswitch.conf || return
+    sed -E 's/(group:.*) winbind/\1/;' -i /etc/nsswitch.conf
+}
+
 rollback_nsswitch()
 {
     sed -E 's/(passwd:.*) sss/\1/;' -i /etc/nsswitch.conf
@@ -90,7 +102,29 @@
     return $RETVAL
 }
 
+enable_winbind()
+{
+    change_winbind_nsswitch || return
+    control system-auth winbind || return
+    reexecute_daemon
+}
+
+disable_winbind()
+{
+    rollback_winbind_nsswitch || return
+    control system-auth local || return
+    reexecute_daemon
+}
+
 case "$1" in
+    enable-winbind)
+        enable_winbind
+        RETVAL=$?
+        ;;
+    disable-winbind)
+        disable_winbind
+        RETVAL=$?
+        ;;
     enable)
         enable
         ;;
@@ -98,7 +132,7 @@
         disable
         ;;
     *)
-        echo "${0##*/} {enable|disable}"
+        echo "${0##*/} {enable|disable|enable-winbind|disable-winbind}"
         RETVAL=1
 esac
 
--- a/service/realmd-altlinux.conf
+++ b/service/realmd-altlinux.conf
@@ -33,8 +33,8 @@
 freeipa-client = /usr/sbin/ipa-client-install
 
 [commands]
-winbind-enable-logins = /usr/sbin/control system-auth winbind
-winbind-disable-logins = /usr/sbin/control system-auth local
+winbind-enable-logins = /usr/lib/realmd/realmd-altlinux-helper enable-winbind
+winbind-disable-logins = /usr/lib/realmd/realmd-altlinux-helper disable-winbind
 winbind-enable-service = /sbin/chkconfig winbind on
 winbind-disable-service = /sbin/chkconfig winbind off
 winbind-restart-service = /sbin/service winbind restart