LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 04-03-2007, 08:01 AM   #1
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Rep: Reputation: 30
Can't join Windows 2k Domain


Hey all,

I am getting the following error when trying to join a Win2k domain for my Samba File Server:
Code:
 [2007/04/03 08:52:12, 0] utils/net_ads.c:ads_startup(289)
  ads_connect: Operations error
Kerberos seems to be working as the following command works:
Code:
kinit -V administrator@my.windows.domain
Password for administrator@my.windows.domain: 
Authenticated to Kerberos v5
As do these:
Code:
klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrator@my.windows.domain

Valid starting     Expires            Service principal
04/03/07 08:55:11  04/03/07 15:35:11  krbtgt/my.windows.domain@my.windows.domain

Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

net ads info
Failed to get server's current time!
LDAP server: my.servers.ip
LDAP server name: my.servers.ldap.name
Realm: my.windows.domain
Bind Path: dc=mydc1,dc=mydc2,dc=mydc3,dc=mydc4
LDAP port: 389
Server time: Wed, 31 Dec 1969 19:00:00 EST
KDC server: my.servers.ip
Server time offset: 0

net ads lookup
Information for Domain Controller: 64.72.0.87

Response Type: SAMLOGON
GUID: my-GUID
Flags:
        Is a PDC:                                   yes
        Is a GC of the forest:                      yes
        Is an LDAP server:                          yes
        Supports DS:                                yes
        Is running a KDC:                           yes
        Is running time services:                   yes
        Is the closest DC:                          yes
        Is writable:                                yes
        Has a hardware clock:                       no
        Is a non-domain NC serviced by LDAP server: no
Forest:                 my.domain.name
Domain:                 my.domain.name
Domain Controller:      my.domain.controller.name
Pre-Win2k Domain:       pre.win2k.domain.name
Pre-Win2k Hostname:     pre.win2k.host.name
Site Name:              Default-First-Site-Name
Site Name (2):          Default-First-Site-Name
NT Version: 5
LMNT Token: ffff
LM20 Token: ffff
The computer has never been joined to the domain before and it's name is not under AD Users/Computers to delete.

Any suggestions as to where to look or a possible solution?

Thanks in advance.
 
Old 04-03-2007, 09:06 AM   #2
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
Did some further digging and found that the service winbind isn't running. I ran a "service winbind start" and it said it started but it's not running. I don't see it in the "ps ax | less" output.

I checked the log and this is what I have:
Code:
[2007/04/03 10:05:14, 1] nsswitch/winbindd.c:main(953)
  winbindd version 3.0.24-3.fc6 started.
  Copyright The Samba Team 2000-2004
[2007/04/03 10:05:14, 0] nsswitch/winbindd_util.c:init_domain_list(518)
  Could not fetch our SID - did we join?
[2007/04/03 10:05:14, 0] nsswitch/winbindd.c:main(1051)
  unable to initalize domain list
Thanks again!
 
Old 04-03-2007, 10:24 AM   #3
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
Ok, did some more digging. Ran the command "service winbind status" which returned this error:
Code:
winbindd dead but pid file exists
Upon Googling I found this article in the RedHat KB. I am running Fedora Core 6 just as a heads up.
http://kbase.redhat.com/faq/FAQ_85_5403.shtm

I disabled SELinux for the whole system and also just for Samba. Neither worked.

Any suggesstions?


Thanks again!
 
Old 04-04-2007, 07:11 AM   #4
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
Did some more digging and found a clue at this thread:
http://lists.samba.org/archive/samba...ry/129925.html

Apparently DNS must be running on the DC and the Samba box has to be pointed to it as it's first nameserver in /etc/resolv.conf.

Now I get the error:
Code:
Failed to join the Domain!
Edit: Another note...after setting that up winbind starts up and works properly.

Last edited by caps_phisto; 04-04-2007 at 07:12 AM.
 
Old 04-04-2007, 08:40 AM   #5
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
Found the command:
Code:
 net ads testjoin -U administrator@my.windows.domain
It yeilded the following results:
Code:
[2007/04/04 09:37:07, 0] libads/kerberos.c:ads_kinit_password(208)
  kerberos_kinit_password MYSAMBASERVER$@MY.WINDOWS.DOMAIN failed: Clients credentials have been revoked
[2007/04/04 09:37:07, 0] utils/net_ads.c:ads_startup(289)
  ads_connect: Clients credentials have been revoked
Join to domain is not valid
Still looking.....any ideas?
 
Old 04-04-2007, 09:10 AM   #6
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
The above error was because someone tried helping me by adding the computer account to the AD and then deleted it. I have since set my machine up with a new host name and this is the "net ads testjoin" output:
Code:
[2007/04/04 10:07:25, 0] libads/kerberos.c:ads_kinit_password(208)
  kerberos_kinit_password MY.NEW.HOSTNAME$@MY.WINDOWS.DOMAIN failed: Client not found in Kerberos database
[2007/04/04 10:07:25, 0] utils/net_ads.c:ads_startup(289)
  ads_connect: Client not found in Kerberos database
Join to domain is not valid
I also looked in /var/log/samba/log.wb-MYWINDOWSDOMAIN and found:
Code:
[2007/04/04 09:50:38, 1] nsswitch/winbindd_ads.c:ads_cached_connection(114)
  ads_connect for domain SHORTDOMAINNAME failed: Cannot read password
Any suggesstions?

Thanks again!
 
Old 04-04-2007, 09:21 AM   #7
caps_phisto
Member
 
Registered: Sep 2004
Location: NH
Distribution: FC6, FC1-4, RH9, Gentoo 2006.0/1, Slackware 10.1/2,11, Vector SOHO 5.0.1
Posts: 237

Original Poster
Rep: Reputation: 30
Got It!

Figured it out.

The command I needed to run to join the domain was:
Code:
 net ads join -S 64.72.0.87 -U Administrator%<my windows admin password>
This initially didn't work due to the fact that my password contained special characters like the single quote character " ' ". This would dump me to the familiar Linux prompt ">" as Linux was expecting more input.

I changed my Windows Admin Password and voila! I Joined my Domain.

I hope all my investigating helps someone else out in the future.

To help even further this was the article I started with:
http://www.netadmintools.com/art172.html


Thanks again!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Help using 'net join' to join a windows domain Wapo Linux - Networking 1 04-28-2006 02:30 AM
How to join windows xp in samba domain jhone_redhat Linux - Networking 1 02-04-2006 08:52 AM
Join linux to Windows domain CalibraTeam Slackware 8 10-20-2005 02:35 AM
How join a Linux PC to a domain in Windows spurs_adr Linux - Networking 5 07-18-2005 04:11 PM
How to Join a windows 2003 domain bballshawn11 Linux - Networking 4 06-02-2004 10:15 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 05:33 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration