How can I set up my Linux box so that, if the Active Directory domain controller is down, I can still log in as root, without any timeouts or delays?

Following the example of most of the documentation out there, I've listed pam_winbind.so before pam_unix.so in my /etc/pam.d configurations. I believe that this is the cause of the problem. I remember seeing alternate /etc/pam.d setups that change the order and maybe add either pam_localuser or pam_succeed_if (to see if the uid is less than 500), but I can't find any specifics now (and I'm not enough of an expert in PAM to quickly and easily come up with a robust configuration on my own).

What is the recommended setup for PAM with Winbind to avoid timeouts and delays if Active Directory is unavailable?