search for "VARIABLE SUBSTITUTIONS"
%S the name of the current service, if any
%D name of the domain or workgroup of the current user
%w the winbind separator
%H the home directory of the user given by %u
%U session username (the username that the client wanted, not necessarily the same as the one they got)
so %D%w%S in your case might translate to something like: TUX-NET\some-name-here
look at this:
only user (S)
This is a boolean option that controls whether connections with usernames not
in the user list will be allowed. By default this option is disabled so that
a client can supply a username to be used by the server. Enabling this param‐
eter will force the server to only use the login names from the user list and
is only really useful in security = share level security.
Note that this also means Samba won't try to deduce usernames from the ser‐
vice name. This can be annoying for the [homes] section. To get around this
you could use user = %S which means your user list will be just the service
name, which for home directories is the name of the user.