Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two servers which were up until recently authenticating against the companies Active Directory Domain controller. I believe a recent change to the Active Directory administrator password caused the servers to stop authenticating against AD. I tried to add the servers back to the domain using the command:

domainjoin-cli join adusername

this seemed to work without complaints, but when I try to login via ssh with my domain account, I get an invalid password error. When I run the command:


it prints all of the domain users, and looking up my own account, I see that it is valid and my password hasn't expired. I also ran

lw-get-status and received the following:

LSA Server Status:

Agent version: 5.0.0 Uptime: 0 days 3 hours 35 minutes 46 seconds

[Authentication provider: lsa-activedirectory-provider]

    Status:        Online
    Mode:          Un-provisioned
    Site:          Default-First-Site-Name
    Online check interval:  300 seconds
    \[Trusted Domains: 1\]

    \[Domain: EXAMPLE\]

            DNS Domain:
            Netbios name:     EXAMPLE
            Forest name:
            Trustee DNS name:
            Client site name: Default-First-Site-Name
            Domain SID:       S-1-5-24-1081533780-4562211299-822531512
            Domain GUID:      057f0239-7715-4711-e64b-eb5eeed20e65
            Trust Flags:      \[0x001d\]
                              \[0x0001 - In forest\]
                              \[0x0004 - Tree root\]
                              \[0x0008 - Primary\]
                              \[0x0010 - Native\]
            Trust type:       Up Level
            Trust Attributes: \[0x0000\]
            Trust Direction:  Primary Domain
            Trust Mode:       In my forest Trust (MFT)
            Domain flags:     \[0x0001\]
                              \[0x0001 - Primary\]

            \[Domain Controller (DC) Information\]

                    DC Name:    
                    DC Address: 
                    DC Site:              Default-First-Site-Name
                    DC Flags:             \[0x000003fd\]
                    DC Is PDC:            yes
                    DC is time server:    yes
                    DC has writeable DS:  yes
                    DC is Global Catalog: yes
                    DC is running KDC:    yes

[Authentication provider: lsa-local-provider]

    Status:        Online
    Mode:          Local system 

Anyone got any ideas what might be occurring?

Thanks in advance!

share|improve this question
Additional Info: It would appear that this only affects users who have previously logged onto the server. When another AD user logs onto the system for the first time, they are allowed access. – purpletonic Feb 23 '10 at 10:18

I work for Likewise Software and was forwarded your request for help. The output you have given looks correct and it looks like a properly joined machine.

Please provide me with the following things so I can try to help you out.

  1. OS release (e.g. RHEL 5.3 or Ubuntu 8.10)
  2. Version of Likewise Open (run, without quotes, "cat /opt/likewise/data/VERSION" and post results)
  3. The contents of /etc/likewise/lsassd.conf (run, without quotes, "cat /etc/likewise/lsassd.conf" and post results)


Yvo van Doorn

share|improve this answer
Thanks for your help Yvo. 1. The machine is running Ubuntu 9.10. 2. The folder /opt/likewise doesn't exist, which confused me when reading the documentation. Presumably this is because it's a Ubuntu installation? 3. The conf file was found in /etc/likewise-open5/lsassd.conf, I've removed the lines starting with # for brevity, and pasted the results below: – purpletonic Feb 24 '10 at 11:43
/etc/likewise-open5/lsassd.conf [global] domain-separator = \ [pam] log-level = error [auth provider:lsa-activedirectory-provider] path = /usr/lib/likewise-open5/ login-shell-template = /bin/bash homedir-template = %H/%D/%U ldap-sign-and-seal = false cache-entry-expiry = 4h machine-password-lifespan = 30d space-replacement = ^ cell-support = unprovisioned [auth provider:lsa-local-provider] path = /usr/lib/likewise-open5/ password-lifespan = 30d password-change-warning-time = 14d – purpletonic Feb 24 '10 at 11:43
up vote 0 down vote accepted

This was resolved when my current active directory password expired and I had to set a new one. Still unsure why this occurred though...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.