Linux Desktop – How to Join an Active Directory Domain (general)

Not just for horizon view but since this is part of a series….

Getting Linux desktops to join an active directory domain is now fairly simple, it used to be quite painful and often a bit hit and miss.

Prep work

  • I’ve create a top level OU called Horizon and a nested OU called Virtual_Desktops.
  • A service account has been created called domainjoin, that has the following permissions to the relevant OU
    • Read All Properties
    • Write All Properties
    • Read Permissions
    • Reset Password
    • Create Computer Objects
    • Delete Computer Objects

Here’s the procedure for Centos (RedHat too) and Ubuntu.

Ubuntu 18.04 LTS

  1. Open a terminal and run the following to get the required dependencies. Note that during the krb5-user install your be asked for the domain name. Fill it in in CAPITAL letters.
  2. sudo apt-get update sudo apt-get upgrade sudo apt-get install realmd sssd sssd-tools oddjob oddjob-mkhomedir adcli samba-common krb5-user
  3. Run the pam-auth-update command and select Create Home Directory on Login
  4. The next set of commands creates a computer account in the following Virtual_Desktops OU, nested under Horizon and joins the desktop to the domain.
  5. sudo echo [domainjoin_password] |sudo realm join --computer-ou="ou=Virtual_Desktops,ou=Horizon,dc=port115,dc=com" --user=domainjoin port115.com
  6. Since there is no confirmation you’ve joined the domain correctly run the following command realm list. You’ll get an output stating things like the domain name. If the desktop didn’t join successfully, there’ll be no output.
  7. You should now be able to login using DOMAIN\user

CentOS 7.X

  1. Open a terminal and run the following as root to get the required dependencies. Note that during the krb5-user install your be asked for the domain name. Fill it in in CAPITAL letters.
  2. yum -y update yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools ntpdate ntp libvirt-client virsh net-destroy default # This might not be nessesary, depending on your base install virsh net-undefine default # This might not be nessesary, depending on your base install service libvirtd restart # This might not be nessesary, depending on your base install systemctl enable ntpd.service ntpdate 0.uk.pool.ntp.org systemctl start ntpd.service 
  3. The next set of commands creates a computer account in the following Virtual_Desktops OU, nested under Horizon and joins the desktop to the domain.
  4.  echo [domainjoin_password] | realm join --computer-ou="ou=Virtual_Desktops,ou=Horizon,dc=port115,dc=com" --user=domainjoin port115.com exit
  5. Since there is no confirmation you’ve joined the domain correctly run the following command realm list. You’ll get an output stating things like the domain name. If the desktop didn’t join successfully, there’ll be no output.
  6. You should now be able to login using DOMAIN\user

Leave a Reply

Your email address will not be published.