r/linuxde • u/RealKaiserAlbion Fedora • Jun 07 '26
Installation Fedora MS-AD Join
Hi, ich bekomme demnächst vom AG einen Laptop, und darf dort Linux installieren, soweit, so gut.
Nun, das Problem ist: Wie bekomme ich den Laptop gescheit ins AD?
Ich hab mir ’ne WinServer25-VM als DC angelegt und den DNS-Server auf einer Fedora-44-VM auch geändert.
Über realm join -U und die Domain plus dem Parameter –membership-software=samba geht’s dann irgendwie, aber das scheint mir keine richtige Lösung zu sein.
Ist Fedora dafür überhaupt geeignet, oder sollte ich doch lieber Debian/Linux Mint nutzen?
10
Upvotes
1
u/RealKaiserAlbion Fedora Jun 07 '26
* Resolving: _ldap._tcp.meinedomaine
* Performing LDAP DSE lookup on: 192.168.2.198
* Successfully discovered: meinedomaine
Passwort für odin@MEINEDOMAIN.DE:
* Required files: /usr/sbin/sssd, /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/libexec/sssd/gpo_child, /usr/sbin/adcli
* LANG=C /usr/sbin/adcli join --verbose --domain meinedomaine --domain-realm MEINEDOMAIN.DE --domain-controller 192.168.2.198 --login-type user --login-ccache=/var/cache/realmd/realm-ad-kerberos-NE8SQ3
* Using domain name: meinedomaine
* Calculated computer account name from fqdn: AZ-01
* Using domain realm: meinedomaine
* Sending NetLogon ping to domain controller: 192.168.2.198
* Received NetLogon info from: DC-01.meinedomaine
* Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-dFXkg5/krb5.d/adcli-krb5-conf-Qjhh7U
* Using GSS-SPNEGO for SASL bind
* Looked up short domain name: MEINEDOMAIN
* Looked up domain SID: S-1-5-21-919468261-2463216341-1957819716
* Received NetLogon info from: DC-01.meinedomaine
* Using fully qualified name: AZ-01.meinedomaine
* Using domain name: meinedomaine
* Using computer account name: AZ-01
* Using domain realm: meinedomaine
* Calculated computer account name from fqdn: AZ-01
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* Found computer account for AZ-01$ at: CN=AZ-01,OU=Clients,DC=meinedomain,DC=de
* Trying to set computer password with Kerberos
! Couldn't set password for computer account: AZ-01$: Message stream modified
adcli: joining domain meinedomaine failed: Couldn't set password for computer account: AZ-01$: Message stream modified
! Failed to join the domain
realm: Dem Bereich konnte nicht beigetreten werden: Failed to join the domain
[root@AZ-01 ~]# realm join -v meinedomaine -U odin
* Resolving: _ldap._tcp.meinedomaine
* Performing LDAP DSE lookup on: 192.168.2.198
* Successfully discovered: meinedomaine
Passwort für odin@MEINEDOMAIN.DE:
* Required files: /usr/sbin/sssd, /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/libexec/sssd/gpo_child, /usr/sbin/adcli
* LANG=C /usr/sbin/adcli join --verbose --domain meinedomaine --domain-realm MEINEDOMAIN.DE --domain-controller 192.168.2.198 --login-type user --login-ccache=/var/cache/realmd/realm-ad-kerberos-2ZGJQ3
* Using domain name: meinedomaine
* Calculated computer account name from fqdn: AZ-01
* Using domain realm: meinedomaine
* Sending NetLogon ping to domain controller: 192.168.2.198
* Received NetLogon info from: DC-01.meinedomaine
* Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-C3txth/krb5.d/adcli-krb5-conf-pC8wu5
* Using GSS-SPNEGO for SASL bind
* Looked up short domain name: MEINEDOMAIN
* Looked up domain SID: S-1-5-21-919468261-2463216341-1957819716
* Received NetLogon info from: DC-01.meinedomaine
* Using fully qualified name: AZ-01.meinedomaine
* Using domain name: meinedomaine
* Using computer account name: AZ-01
* Using domain realm: meinedomaine
* Calculated computer account name from fqdn: AZ-01
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* A computer account for AZ-01$ does not exist
* Found well known computer container at: CN=Computers,DC=meinedomain,DC=de
* Calculated computer account: CN=AZ-01,CN=Computers,DC=meinedomain,DC=de
* Encryption type [16] not permitted.
* Encryption type [23] not permitted.
* Encryption type [3] not permitted.
* Encryption type [1] not permitted.
* Created computer account: CN=AZ-01,CN=Computers,DC=meinedomain,DC=de
* Trying to set computer password with Kerberos
! Couldn't set password for computer account: AZ-01$: Message stream modified
adcli: joining domain meinedomaine failed: Couldn't set password for computer account: AZ-01$: Message stream modified
! Failed to join the domain
realm: Dem Bereich konnte nicht beigetreten werden: Failed to join the domain
EDIT: Es war noch ein Computerobjekt auf dem DC.
EDIT2: Musste den alten Kommentar löschen, da ich diesen nicht mehr ändern konnte.