1

I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)

net ads join -U <username>

Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ? And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.

Improve this question
3
  • 1
    Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html
    – user459652
    Dec 12, 2018 at 17:26
  • Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully.
    – Oscar
    Dec 13, 2018 at 9:03
  • 1
    You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there.
    – user459652
    Dec 13, 2018 at 14:37

2 Answers 2

Reset to default
2

-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.

The process would be:

  • get ticket: kinit <user>, where <user> is e. g. a Domain Admin account

  • execute the join: net ads join -k

You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.

As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.

If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.

Improve this answer
2
  • Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine.
    – Oscar
    Dec 14, 2018 at 9:11
  • check the createcomputer option for net ads join for the OU.
    – Sebastian Stark
    Dec 15, 2018 at 21:13
0

Answer to this was to use 

net ads join -U username%password

This and a new user on domain that has a single right of adding devices to domain fixed my issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .