Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client trying to join his newly updated ZFS/Solaris box to my Windows AD 2003/2008 domain. Here is the command he is using and the error he is getting;

root@xxx:/etc/inet# smbadm join -u USER DOMAIN
After joining DOMAIN the smb service will be restarted automatically.Would you like to continue? [no]: yes
Enter domain password:
Joining DOMAIN ... this may take a minute ...
Please refer to the system log for more information.

From /var/adm/messages:
Sep 22 10:12:00 xxx smbd[593]: [ID 702911 daemon.error] smbrdr_exchange[116]: failed (-3)
Sep 22 10:12:01 xxx smbd[593]: [ID 232655 daemon.notice] ldap_modify: Insufficient access
Sep 22 10:12:01 xxx smbd[593]: [ID 898201 daemon.notice] Unable to set the TRUSTED_FOR_DELEGATION userAccountControl flag on the machine account in Active Directory.  Please refer to the Troubleshooting guide for more information.
Sep 22 10:12:01 xxx smbd[593]: [ID 526780 daemon.notice] Failed to establish NETLOGON credential chain
Sep 22 10:12:01 xxx smbd[593]: [ID 871254 daemon.error] smbd: failed joining DOMAIN (UNSUCCESSFUL)
share|improve this question

It looks like the credentials that he is using don't have permission to join a machine to AD. Is the user able to join Windows machines? If not, they won't be able to join non-Windows machines.

If you pre-create the computer object in Active Directory, you can delegate the ability to bind a machine to the object by entering the username of the user in the area located below:

New Object dialogue

share|improve this answer
Credentials on the AD object was my first stop. However its all in place. The user account has the appropriate level of access on the object and should be able to add it to the domain. Any other ideas? – user95587 Sep 22 '11 at 21:47
@user95587 What do you mean by "appropriate level of access"? Is the account in the Domain Admins group or not? – Tom Shaw Sep 23 '11 at 1:37
@TomShaw One need not necessarily (nor by default) be a domain admin to join a machine to a domain. This can be changed. – 84104 Sep 23 '11 at 1:51
@user84104 The Solaris CIFS Service Troubleshooting Guide suggests otherwise. I'll defer to you if you know another way, but it's still worth confirming whether user95587 knows about this. – Tom Shaw Sep 23 '11 at 1:58
@Tom that's entirely AD specific and not Solaris specific. The guide likely says that to eliminate permission issues, since it's a troubleshooting guide. – MDMarra Sep 23 '11 at 2:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.