[Samba] Failed to join domain: failed to find DC for administrator@XYZ

[Yanni]

Hello everyone

I had samba 4.1 working as a member server to a windows 2012 AD in a
test environment for a while now until I had to re-install the windows
server from scratch. I have the new AD setup with the same NETBIOS name
but now I have problems re-joining the samba box to the new AD. It looks
like a DNS issue but I am unable to understand why. After the
ire-install, I got a new Kerberos ticket with no problem:

[root@gouda ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admini...@TESTAD.BIO.UCL.AC.UK

Valid starting Expires Service principal
03/09/2015 10:12:56 03/09/2015 10:22:53
krbtgt/TESTAD.BIO...@TESTAD.BIO.UCL.AC.UK
-------------------------------------------

Then I tried to join samba to the new AD:

[root@gouda ~]# net ads join admini...@TESTAD.BIO.UCL.AC.UK
Enter root's password:
Failed to join domain: failed to find DC for domain
admini...@TESTAD.BIO.UCL.AC.UK
--------------------------------------------
some info:
AD IP: 192.21.35.5
Samba: 192.21.35.136
DNS: is running on the windows server.
--------------------------------------------

On the samba box resolv.conf looks like this:

nameserver 192.21.35.5
search testad.bio.ucl.ac.uk
domain testad.bio.ucl.ac.uk

etc/hosts looks like this:

127.0.0.1 localhost localhost.localdomain localhost4
localhost4.localdomain4
::1 localhost localhost.localdomain localhost6
localhost6.localdomain6

192.21.35.5 testserver1 testserver1.testad.bio.ucl.ac.uk
-------------------------------------------
On the windows server:
Primary DNS: 192.21.35.5
Secondary DNS: 127.0.0.1

The hosts file in C:\Windows\System32\drivers\etc is empty.

Do you know why I can't join the samba box to the new AD domain?
If you have any ideas/suggestions please let me know.

Many thanks
Yanni








--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Rowland Penny]

Remove the 'domain' line, you cannot have both, last one is the one that
is used.

>
> etc/hosts looks like this:
>
> 127.0.0.1 localhost localhost.localdomain localhost4
> localhost4.localdomain4
> ::1 localhost localhost.localdomain localhost6
> localhost6.localdomain6
>
> 192.21.35.5 testserver1 testserver1.testad.bio.ucl.ac.uk

The last line should refer to the machine it is running on unless the
machine gets it DNS info via DHCP, in which case remove the line.

> -------------------------------------------
> On the windows server:
> Primary DNS: 192.21.35.5
> Secondary DNS: 127.0.0.1
>

You don't need both lines, they mean the same thing.

> The hosts file in C:\Windows\System32\drivers\etc is empty.
>
> Do you know why I can't join the samba box to the new AD domain?
> If you have any ideas/suggestions please let me know.
>

Probably yes, you seem to have made a typo, it should have been:

net ads join -U admini...@TESTAD.BIO.UCL.AC.UK

Rowland

[Yanni]

Hi Rowland

I deleted the "domain" line from /etc/resolv.conf.

Sorry I didn't quite understand what you really meant about the last
line in /etc/hosts
The last line in "/etc/hosts"
192.21.35.5 testserver1 testserver1.testad.bio.ucl.ac.uk is the Win-AD.
Samba machine does not get its IP from DHCP so I did not remove that line.

Removed 127.0.0.1 DNS from Win-AD, then restarted samba and tried to
join it again to the AD domain but I get the very similar error below:

net ads join -U admini...@TESTAD.BIO.UCL.AC.UK

Failed to join domain: failed to lookup DC info for domain
'TESTAD.BIO.UCL.AC.UK' over rpc: Undetermined error

So at the moment this is how my config files look like:
pastebin.com/XGD9zy2W

Could you please have a look if you the time to do so.

Thanks a lot

[Rowland Penny]

On 04/09/15 14:49, Yanni wrote:
> Hi Rowland
>
> I deleted the "domain" line from /etc/resolv.conf.
>
> Sorry I didn't quite understand what you really meant about the last
> line in /etc/hosts
> The last line in "/etc/hosts"
> 192.21.35.5 testserver1 testserver1.testad.bio.ucl.ac.uk is the
> Win-AD. Samba machine does not get its IP from DHCP so I did not
> remove that line.

Active directory lives on DNS, i.e. you must have DNS working before
trying to use AD, so that line in /etc/hosts should be redundant, if you
need it to find the AD DC, then DNS is *not* working.

>
> Removed 127.0.0.1 DNS from Win-AD, then restarted samba and tried to
> join it again to the AD domain but I get the very similar error below:
>
> net ads join -U admini...@TESTAD.BIO.UCL.AC.UK
> Failed to join domain: failed to lookup DC info for domain
> 'TESTAD.BIO.UCL.AC.UK' over rpc: Undetermined error
>
> So at the moment this is how my config files look like:
> pastebin.com/XGD9zy2W
>
> Could you please have a look if you the time to do so.
>
> Thanks a lot
>

You only need this in /etc/krb5.conf

[libdefaults]
default_realm = TESTAD.BIO.UCL.AC.UK
dns_lookup_realm = false
dns_lookup_kdc = true

Can you ping the AD DC from the machine you are trying to join ?
If you can, comment out the AD DC line in /etc/hosts and try again.
If you cannot, you have a DNS problem.

Rowland