Joining a domain¶

Exercise joining-a-domain-annex.pdf · PDF

Marta sits down at a Windows PC she has never used. There is no account called marta on it. She types her name and password, and she is in. A minute later she does the same on a Debian laptop. Same name, same password, two operating systems. What did those two machines do beforehand to make that possible?

Your domain controller dc1 is running, but right now the domain has exactly one computer in it: dc1 itself. A domain with no clients is like a festival with an entrance and no bars. This page connects the bars.

What joining means¶

Remember the festival: you show your ID once at the entrance and get a wristband (a Kerberos ticket). But a wristband is only useful at bars that have signed up with the organisers. A bar that never registered does not know what a wristband is.

Joining a domain is that registration: the computer goes to the domain controller, a domain administrator vouches for it, and from then on the computer accepts the domain's users.

Two things happen during a join:

• The DC creates a computer account for the PC in the directory, next to the user accounts. Its name is the PC's name with a $ at the end, such as WIN11$. Computers have passwords too; they manage them by themselves.
• The PC stores the domain's name and from now on offers a second kind of login: accounts it does not have, checked by the DC.

That is why a join asks for a domain administrator's password: adding a computer to the company is an act of trust.

Three conditions before you join¶

The first one is the step that fails in real companies. If the PC cannot find the controller in DNS, nothing after it works, and the error message talks about everything except DNS.

A user to log in with¶

On dc1, create Marta in the domain:

sudo samba-tool user add marta --given-name=Marta --surname=Soler
sudo samba-tool user list

The tool asks for the password twice (the domain refuses anything shorter than 7 characters or too simple) and answers User 'marta' added successfully. The list shows marta, Administrator, Guest and krbtgt. That last one is the account of the Kerberos service itself: the one that signs every wristband.

Windows joins¶

1. Point the DNS at the controller¶

PowerShell as administrator:

Get-NetAdapter
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.122.20
nslookup -type=SRV _ldap._tcp.tramuntana.internal
nslookup debian.org

• Get-NetAdapter tells you the adapter's name (usually Ethernet); use it in the second line.
• The SRV answer must name dc1.tramuntana.internal and port 389: the same record you read on the server, now asked by the client.
• debian.org still resolves, because the DC forwards what it does not know to 192.168.122.1.

2. Join¶

Win+R → sysdm.cpl → tab Computer Name → Change... → Member of: Domain → tramuntana.internal → OK. Windows asks for an account allowed to join computers: Administrator with the domain's password, not the local Windows administrator. A welcome message confirms it; restart when asked.

3. Sign in as Marta, and prove it¶

At the sign-in screen choose Other user and type TRAMUNTANA\marta. The first sign-in takes a while: Windows is building her profile. Then, in a terminal:

whoami
echo %LOGONSERVER%
klist

Back on dc1, sudo samba-tool computer list used to print only DC1$. Now there is a second line: your Windows PC's name followed by $.

What happened at that login¶

flowchart LR
    W["<b>win11</b><br>Marta types her password"] -->|"1. DNS: who is the DC?<br>SRV records"| DNS["<b>DNS on dc1</b>"]
    W -->|"2. Kerberos: proof of password"| KDC["<b>KDC on dc1</b><br>gives a TGT"]
    W -->|"3. LDAP: who is marta,<br>which groups?"| LDAP["<b>Directory on dc1</b>"]
    W -->|"4. creates C:\Users\marta"| PROF["<b>Profile</b><br>on this PC"]

The account lives in the directory. The profile — her desktop, her documents — is created on each PC she uses. Her files are not on the server just because her account is.

Two kinds of account on one PC¶

Sign out and sign in with the local account you have used all year, typed as .\yourname. The .\ means "an account of this computer". Both work:

The same domain account can be written two ways: TRAMUNTANA\marta (NetBIOS style) and marta@tramuntana.internal, the user principal name (UPN), which looks like an e-mail address. Both work at the sign-in screen.

Linux joins too¶

An Active Directory domain is DNS + Kerberos + LDAP, and Linux speaks all three. Two pieces of software do the work:

• realmd provides the realm command, which discovers and joins the domain.
• SSSD (System Security Services Daemon) is a service that looks up users in the directory and checks their passwords with Kerberos, at every login.

1. DNS first, again¶

nmcli -t -f NAME con show --active
sudo nmcli con mod "Wired connection 1" ipv4.dns 192.168.122.20 ipv4.ignore-auto-dns yes
sudo nmcli con up "Wired connection 1"
getent hosts dc1.tramuntana.internal

The first command gives the connection's name; use yours in the next two. The last must answer 192.168.122.20 dc1.tramuntana.internal.

2. Discover and join¶

sudo apt install -y realmd sssd sssd-tools libnss-sss libpam-sss adcli
sudo realm -v discover tramuntana.internal
sudo realm join -v -U Administrator tramuntana.internal
sudo pam-auth-update --enable mkhomedir
realm list

• discover finds the domain through DNS and reports its type (active-directory) and the software it needs.
• join asks for the Administrator's password, creates the computer account and writes /etc/sssd/sssd.conf.
• mkhomedir tells PAM to create a home folder the first time a domain user logs in.

3. Marta on Linux¶

getent passwd marta@tramuntana.internal
grep marta /etc/passwd
id marta@tramuntana.internal
su - marta@tramuntana.internal
pwd
exit

getent prints a line in the shape of /etc/passwd, but grep marta /etc/passwd finds nothing: the answer came from the directory, through SSSD. id shows a large user ID and the group domain users@tramuntana.internal. SSSD computes that ID from Marta's identifier in the directory, so it is the same on every Linux machine of the domain. On dc1, sudo samba-tool computer list now has a third line, DEB-LAB$.

When the join fails¶

Key takeaways¶

• Joining registers a computer in the domain: the DC creates a computer account ending in $, and the PC starts accepting domain users.
• Before a join: the PC's DNS must be the DC, the clocks must agree within 5 minutes, and Windows must not be Home.
• Join once per computer (an administrator); log in every day (any domain user).
• On a joined PC, .\name is a local account and TRAMUNTANA\marta (or the UPN marta@tramuntana.internal) is a domain account.
• Linux joins with realm join; SSSD looks up domain users and checks their passwords with Kerberos.
• The account lives in the directory; the profile is created on each PC the user signs in to.

Quick check¶

One user, three machines, one password. Next, the whole company goes into the directory, in order, by department — Domain users, groups and OUs.