Fedora 30 fails to join Active Directory

Ask Fedora
1

Hi there,

I’m trying to configure our Fedora workstations to join our windows active directory with the following command:

realm join -U administrator --client-software=sssd domain.com

It gives me the following errors:

Couldn't create computer account: CN=F3BLK21, CN=Computers, DC=Domain, DC=com
problem 1006 (ATT_OR_VALUE_EXISTS), ATT 90303 (servicePrincipalName)

The machine hasn’t been added previously to the domain (Checking AD I can confirm there’s no computer object there for that machine).
Also this works fine on Centos 7 and Red Hat. All the same packages for Centos 7 and Red Hat 7 for this purpose is also installed on Fedora.

Any Ideas ?

Thanks

1 Like
2

Try to temporary disable SELinux, check the service, test domain discovery:

sudo setenforce 0
systemctl status sssd.service
realm discover example.com

See also: Join in Active Directory Domain on Fedora 30

3

Hi,

Sorry for the late reply. SELinux was disabled already. So that’s not the issue unfortunately.
SSSD service is also running. Realm discover works fine as well.

Thanks

1 Like
4

You should compare the related configs:

/etc/resolv.conf
/etc/nsswitch.conf
/etc/krb5.conf
/etc/krb5.conf.d/*
/etc/sssd/sssd.conf
/etc/pam.d/system-auth

I had a legacy domain that required to disable the /etc/krb5.conf.d/crypto-policies.