Samba Active Directory

1.5.1.4 Join a computer to a Samba Domain

The procedure to join other workstations to the samba domain is written as below

1. Prerequisites

set the DNS — client must use DC Samba as primary DNS:

bash

# Debian/Ubuntu con netplan
sudo nano /etc/netplan/01-netcfg.yaml

yaml

network:
  ethernets:
    eth0:
      nameservers:
        addresses: [192.168.1.10]   # IP of DC Samba
        search: [yourdomain.local]

bash

sudo netplan apply     # Note: Remember to manually type this command for it to be applied, as rebooting the machine will not execute this command.

sync the clock if needed (Kerberos can hold at max 5 mins of delay):

bash

sudo apt install chrony -y   # o ntp
sudo systemctl enable --now chrony

check DNS domain resolution

bash

host -t SRV _ldap._tcp.tuodominio.local
host -t SRV _kerberos._tcp.tuodominio.local

2. Install necessary packages

bash

sudo apt update
sudo apt install realmd sssd sssd-tools samba-common samba-common-bin krb5-user packagekit adcli -y

During krb5-user installation it asks to set "default realm": you can insert it uppercase (es. YOURDOMAIN.LOCAL), or leave it empty to be configured later with realmd.

3. Check the domain (not necessary, useful for troubleshooting)

bash

sudo realm discover yourdomain.local

it must show domain, configured: kerberos-member, and server-software: active-directory.

4. Do the join

bash

sudo realm join -U administrator yourdomain.local

If you need to specify an OU:

bash

sudo realm join -U administrator --computer-ou="OU=Linux,DC=yourdomain,DC=local" yourdomain.local

5. verify the join

bash

realm list
sudo id "administrator@yourdomain.local"
sudo klist -k /etc/krb5.keytab   # must show the workstation server principal name (SPN)

What to check/do

1. Confirmation from dc1 that the A record is missing

bash

samba-tool dns query 127.0.0.1 vmmaurlx01.local dc2 A -U administrator

should return a result similar to this:

sis@dc1:~$ samba-tool dns query 127.0.0.1 vmmaurlx01.local dc2 A -U administrator

Name=, Records=1, Children=0

A: 172.31.99.142 (flags=f0, serial=146, ttl=900)

sis@dc1:~$

If it returns a "record not found" error, confirm the diagnosis.

The A record for dc2 does not exist at all in the Samba DNS zone (NXDOMAIN + WERR_DNS_ERROR_NAME_DOES_NOT_EXIST). It's not a resolution problem, it's that no one has ever created the record.
This is normal for a Linux member: unlike a Windows client joined to the domain (which does dynamic DNS registration automatically on startup/join),
a Linux member joined via realm join / adcli / net ads join does not automatically register its DNS record unless explicitly configured to do so (typically wit samba_dnsupdate o script di dynamic update via Kerberos).
Two ways:
A) Immediate fix — add record manually from dc1
bash

samba-tool dns add dc1 vmmaurlx01.local dc2 A <IP_di_dc2> -U administrator

Replace <IP_di_dc2> with the real IP of the dc2 machine.
B) Structural fix — automatic dynamic recording on dc2
If dc2 was joined with realm join/adcli, You can force dynamic update with:
bash

sudo net ads dns register -P

(Requires dc2 to have a valid keytab, typically already present if the join was successful)
Or, if you want it to periodically update itself, add this command to a cron/systemd timer.

6. Configurelogin/permissions of domain users

realm join by default limits login to users specified with realm permit:

bash

# permit a single user
sudo realm permit utente@tuodominio.local

# permit all users
sudo realm permit -a

to enable automatic user folder creation:
bash

sudo pam-auth-update --enable mkhomedir


for ask password login 
Every time you join a new Linux client, you must manually repeat the following on the client:
bash
sudo pam-auth-update --enable unix
sudo pam-auth-update --enable sss
These records are static: if the IP of dc2 or ubuntu-quorum changes (e.g., DHCP, VM re-creation), 
the record won't update automatically—you'll need to redo samba-tool dns add (or first delete the old one 
with samba-tool dns delete). If you want dynamic registration to actually work in the future (useful if VMs might 
change IPs), it's worth investigating why sssd's dyndns_update didn't write the record automatically—this 
is often due to Kerberos permissions on the machine account or a time-of-day issue.
7. Test the login
bash

su - user@yourdomain.local

or via SSH from another workstation

8. Configure sudo for domain groups (optional)

bash

sudo visudo

%dominio_admins ALL=(ALL) ALL

(note: % is followed by AD group name, with spaces substituted with "\" or between brackets , depending on the version).