samba - Oct 2019 - Domain Member Join Problems

I'm setting up a domain member with Debian bust ADC and a Debian bust 
domain member.? I've got a windows machine that has joined the domain 
and I can login to it.


The Debian domain member is throwing a DNS error when I do net ads join 
-Uadministrator:

net ads join -Uadministrator
Enter administrator's password:
kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed for 
ldap/athena.edm-inc.com with user[administrator] realm[EDM-INC.COM]: 
Strong(er) authentication required
Using short domain name -- EDM
Joined 'SNAPS2' to dns domain 'edm-inc.com'
DNS Update for snaps2.edm-inc.com failed: ERROR_DNS_UPDATE_FAILED
DNS update failed: NT_STATUS_UNSUCCESSFUL


Joining with samba-tool I get this:

samba-tool domain join EDM MEMBER -Uadministrator
Password for [EDM\administrator]:
WARNING: talloc_steal with references at ../talloc.c:2075
 ??????? reference at ../pytalloc_util.c:182
Joined domain EDM (S-1-5-21-etc...)


Any ideas what's happening?


-- 
Bob Wooldridge
EDM Incorporated

On 08/10/2019 00:04, Robert A Wooldridge via samba
wrote:
> I'm setting up a domain member with Debian bust ADC and a Debian bust 
> domain member.? I've got a windows machine that has joined the domain 
> and I can login to it.
>
>
> The Debian domain member is throwing a DNS error when I do net ads 
> join -Uadministrator:
>
> net ads join -Uadministrator
> Enter administrator's password:
> kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed for 
> ldap/athena.edm-inc.com with user[administrator] realm[EDM-INC.COM]: 
> Strong(er) authentication required
> Using short domain name -- EDM
> Joined 'SNAPS2' to dns domain 'edm-inc.com'
> DNS Update for snaps2.edm-inc.com failed: ERROR_DNS_UPDATE_FAILED
> DNS update failed: NT_STATUS_UNSUCCESSFUL
Never seen that error message before, the join has worked, but adding 
the dns info has failed

Can we see the smb.conf from both machines.
>
>
> Joining with samba-tool I get this:
>
> samba-tool domain join EDM MEMBER -Uadministrator
Never, I repeat, Never, run that command, I am unsure just what you get, 
but it isn't a Unix domain member.

I take it you ran the first command (net ads join), then the samba-tool 
command, if so, you will need to remove all the files (recursively) from 
/var/lib/samba and start again.

Rowland

I suggest, try a stronger password to it matches the minimal debian
requirements.

> > kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed for 
> > ldap/athena.edm-inc.com with user[administrator] realm[EDM-INC.COM]: 
> > Strong(er) authentication required 
Then is most probely will work. 


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland penny via samba
> Verzonden: dinsdag 8 oktober 2019 9:59
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Domain Member Join Problems
> 
> On 08/10/2019 00:04, Robert A Wooldridge via samba wrote:
> > I'm setting up a domain member with Debian bust ADC and a 
> Debian bust 
> > domain member.? I've got a windows machine that has joined 
> the domain 
> > and I can login to it.
> >
> >
> > The Debian domain member is throwing a DNS error when I do net ads 
> > join -Uadministrator:
> >
> > net ads join -Uadministrator
> > Enter administrator's password:
> > kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed for 
> > ldap/athena.edm-inc.com with user[administrator] 
> realm[EDM-INC.COM]: 
> > Strong(er) authentication required
> > Using short domain name -- EDM
> > Joined 'SNAPS2' to dns domain 'edm-inc.com'
> > DNS Update for snaps2.edm-inc.com failed: ERROR_DNS_UPDATE_FAILED
> > DNS update failed: NT_STATUS_UNSUCCESSFUL
> 
> Never seen that error message before, the join has worked, but adding 
> the dns info has failed
> 
> Can we see the smb.conf from both machines.
> 
> >
> >
> > Joining with samba-tool I get this:
> >
> > samba-tool domain join EDM MEMBER -Uadministrator
> 
> Never, I repeat, Never, run that command, I am unsure just 
> what you get, 
> but it isn't a Unix domain member.
> 
> I take it you ran the first command (net ads join), then the 
> samba-tool 
> command, if so, you will need to remove all the files 
> (recursively) from 
> /var/lib/samba and start again.
> 
> Rowland
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>