I am trying to configure a automated join to domain on my Ubuntu workstations. I have everything in place (I at least I believe so as the following command works fine)

net ads join -U <username>

Now I have two questions. Could someone explain to me what the option -k or --kerberos does and when could it be used ? And also has anyone sucesfully automated this process ? I so far have puppet setup to deploy all config files (krb, sssd, samba. All of those are configured and working when done manually) and run the net ads join at the end however it seems to fail (no surprise as I dont provide it with credentials) someone has mentioned to me to run the above command with -k option however that seems to fail too.

  • 1
    Have you set up Kerberos on your realm, or have it set up for you? If not, this is a pretty tall order for a single question. Standard ref: help.ubuntu.com/lts/serverguide/kerberos.html – user459652 Dec 12 '18 at 17:26
  • Yes, sorry I have setup kerberos as well as I have all configuration files in place for sssd and samba. Everything works fine manually I've even setup network hares to mount automatically. However I am looking for a way to automate this specific part. I know I can write a script to do this and either save the credentials or provide them at this point or before hand but I was wondering if there is a way of automating this fully. – Oskar L Dec 13 '18 at 9:03
  • 1
    You should say this in the question, not a comment. Edit the question and make sure everything someone needs to help you is in there. – user459652 Dec 13 '18 at 14:37

-k will use kerberos authentication, so if you have a ticket from a principal that can create computer objects in AD, the net ads join command will work without providing any further credentials.

The process would be:

  • get ticket: kinit <user>, where <user> is e. g. a Domain Admin account

  • execute the join: net ads join -k

You can do this from within a script. You can even consider using msktutil to do this, in case you do not want to have all the samba stuff installed on the client. The msktutil would replace the net ads join command.

As to fully automating that is a bit of a vague question, but the key concept would be to have some way to pre-create the computer accounts in the AD (you can use msktuil, net ads or the Windows GUI for this), then use one of the tools to actually join the client using some default password.

If you have a separate admin group managing the AD they will probably pre-create the computer objects for you. If you have to do that yourself I do not see much usefulness in automating this anyway, as it won't save you any work.

| improve this answer | |
  • Thank's for the explanation, I have decided to go with creating a user that has a single right which is to add computers to domain and use it in a script. I still have to move objects to right OU but that is fine. – Oskar L Dec 14 '18 at 9:11
  • check the createcomputer option for net ads join for the OU. – Sebastian Stark Dec 15 '18 at 21:13

Answer to this was to use

net ads join -U username%password

This and a new user on domain that has a single right of adding devices to domain fixed my issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.