Since the first pass of `pyrocufflink.yml` always fails to start the
*winbind* service (since the machine is not yet a member of the domain),
a second pass is required to start it. It can't be started as part of
the *winbind* role, though, since it would fail. As such, it has to be
started at the very end of the play.
Dustin