I’m trying to join my suse server, which is located in a DMZ, to a windows domain.
I configured samba and kerberos. With kinit i get a ticket. The computer object was created on a RWDC, and replicated to the RODC and is in the cachable group. It seems that Samba is trying to set flags while joining the domain, namely: ACB_WSTRUST and ACB_PWNOEXP. These flags cannot be set. That’s how i interpret the output when i use the net join command.
Fairly common problem not specific to openSUSE (happens on Windows machines too).
Try entering the DC name and IP address into the Hosts file temporarily (can remove after joining the Domain, once joined DNS provides proper name resolution mapping).
After you create your Hosts entry,
You can test your name resolution by PING.
If your name resolution works,
Then you have to consider whether your AD is set up properly because everything should “just work” at that point(Again, using YAST to join the AD).
You can also test by creating another “machine” and trying to join your AD. Try a Windows and another openSUSE. This is a perfect situation where you can use virtualization to create your test machines since virtual machines are so easy to setup (can simply clone an existing if you’ve been using it awhile) and disposable (as easy to create your test, it’s equally easy to destroy when done).
Remember after testing to remove the Machine account from your AD (simple to do).
Always fully update your openSUSE shortly after a new install, particularly if you’re installing from a DVD
I also recommend making all system modifications before taking the next step joining an AD although there may be exceptions and it may not make a diff in most cases. This might include things like configuring SSD settings like “discard” in the fstab.
I already did all this stuff. In fact this thread is kinda my last resort. The machine account is in the RODC replicated group, i get kerberos tickets without a problem. Testjoin is ok. The specific problem is: Samba tries to set flags on the RODC which is by design not possible. ACB_WSTRUST and ACB_PWNOEXP. At least this is what i see in wireshark.
Windows Client can join a domain with the “/readonly” option. AFAIK this is doesn’t work in the net join command. I have no problems joining the domain using the RWDC and Linux.
Maybe uninstall SAMBA client from openSUSE at least temporarily?
If you’re certain the problem appears to be SAMBA related, AFAIK joining the Domain does not require SAMBA. I don’t see any documentation about this and a quick Google search only results in other scenarios, not this.
Of course, you can always re-install SAMBA (at least the client) afterwards.