我正在尝试将我的 Debian 机器连接到 Windows 服务器，但无法工作。
以 root身份返回kinit -V [email protected]
Using default cache: /tmp/krb5cc_0
Using principal: [email protected]
Password for [email protected]:
Authenticated to Kerberos v5
realm discover MYDOMAIN.COM给出
mydomain.com
type: kerberos
realm-name: MYDOMAIN.COM
domain-name: mydomain.com
configured: no
server-software: active-directory
client-software: sssd
required-package: sssd-tools
required-package: sssd
required-package: libnss-sss
required-package: libpam-sss
required-package: adcli
required-package: samba-common-bin
我相信我已经安装了所有必需的软件包，因为dpkg-query -l 'sssd-tools' 'sssd' 'adcli' 'samba-common-bin' 'libnss-sss' 'libpam-sss'返回
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================================-======================-======================-===========================================================================
ii adcli 0.8.2-1+b1 amd64 Tool for performing actions on an Active Directory domain
ii libnss-sss:amd64 1.15.0-3 amd64 Nss library for the System Security Services Daemon
ii libpam-sss:amd64 1.15.0-3 amd64 Pam module for the System Security Services Daemon
ii samba-common-bin 2:4.5.8+dfsg-2+deb9u1+ amd64 Samba common files used by both the server and the client
ii sssd 1.15.0-3 amd64 System Security Services Daemon -- metapackage
ii sssd-tools 1.15.0-3 amd64 System Security Services Daemon -- tools
一切似乎都很好，但我无法加入网络 。realm join --membership-software=adcli MYDOMAIN.COM -U [email protected] --verbose
* Resolving: _ldap._tcp.mydomain.com
* Performing LDAP DSE lookup on: XXX.XX.XXX.XXX
* Performing LDAP DSE lookup on: XXX.XX.XXX.XXX
* Performing LDAP DSE lookup on: XXX.XX.XXX.XXX
* Successfully discovered: mydomain.com
Password for [email protected]:
* Unconditionally checking packages
* Resolving required packages
* LANG=C /usr/sbin/adcli join --verbose --domain mydomain.com --domain-realm MYDOMAIN.COM --domain-controller XXX.XX.XXX.XXX --login-type user --login-user [email protected] --stdin-password
* Using domain name: mydomain.com
* Calculated computer account name from fqdn: myLocalhost
* Using domain realm: mydomain.com
* Sending netlogon pings to domain controller: ldap://XXX.XX.XXX.XXX
* Received NetLogon info from: HI-ROOT03.mydomain.com
* Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-X6zN48/krb5.d/adcli-krb5-conf-6SRoUP
* Authenticated as user: [email protected]
* Looked up short domain name: MYSHORTDOMAIN
* Using fully qualified name: myLocalhost.mydomain.com
* Using domain name: mydomain.com
* Using computer account name: myLocalhost
* Using domain realm: mydomain.com
* Calculated computer account name from fqdn: myLocalhost
* Generated 120 character computer password
* Using keytab: FILE:/etc/krb5.keytab
* Found computer account for myLocalhost$ at: CN=myLocalhost,OU=Employee Computers,OU=Place1,OU=UserDevices,OU=Workstations,OU=ENTERPRISE,DC=mydomain,DC=com
! Cannot set computer password: Access denied
adcli: joining domain mydomain.com failed: Cannot set computer password: Access denied
! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain
答案1
无法设置计算机密码：访问被拒绝
错误消息对我来说似乎很简单。您尝试加入的用户似乎没有权限重置该员工计算机 OU 中现有“myLocalhost”计算机帐户的密码。
应该吗？“myUserName”是否属于域管理员组？如果不是，用户是否已被授予该 OU 中计算机帐户的其他明确权限？管理良好的 Active Directory 中的标准用户帐户通常不能随意加入计算机。