Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During some troubleshooting I deleted the machine account for a Linux server running samba from our AD 2003 domain. We are using Kerberos for authentication, and after I deleted the machine account I tried to join the domain again using

net ads join -U Administrator

But I keep getting Kerberos errors like these:

[2009/08/18 16:14:36, 0] libads/kerberos.c:ads_kinit_password(228)
     kerberos_kinit_password MACHINE$@MY.DOMAIN.COM failed: Client not found in Kerberos database
 Failed to join domain: Improperly formed account name

It appears as if samba remembers that it once had an account with the AD and keeps trying to reconnect to it, but I want to create a new account from scratch. I tried to delete all the .tdb files I could find as well as everything under /var/cache/samba but to no avail - it still behaves the same.

I also tried to create the machine account on the AD side, but then I get a similar error when I try to join, about failure to authenticate with the machine account - it looks like samba tries the previous machine account password and I don't know how to reset it, or even if I could figure out what samba uses - how to set it in the AD.

Any help would be greatly appreciated, as at this point the only thing I can think about is to reformat and reinstall the machine, and I would really REALLY love to not do that.

Thanks in advance.

share|improve this question
Are you using "." as a winbind separator? If not, have you changed the winbind separator? – jneves May 5 '10 at 17:34
up vote 4 down vote accepted

First run a kdestory to remove any reference to the machine account in the local kerberos cache, then manually run kinit administrator@MY.DOMAIN.LOCAL and enter the password.

Then run the net ads join command.

This should give you the kerberos trust to create the machine account without having to try and use the old machine account credentials.

share|improve this answer
Excellent! thanks for the help. – Guss Nov 17 '10 at 8:59

Have you recreating your .tdb file with the smbpasswd command?

share|improve this answer
No - they don't have any interesting passwords that I need to keep so I just delete them and samba recreates them. – Guss Aug 26 '09 at 18:35
I'm not sure you don't need them. :) – kmarsh Aug 26 '09 at 19:38

Have you tried running the "net ads leave" command prior to re-joining? It will probably fail on the AD part of it, since the computer account was already deleted on the AD side.

share|improve this answer
I did - it reported an error but did not provide any other information nor affected the situation in anyway. – Guss Sep 8 '09 at 16:11

Do a quick experiment, change samba name in smb.conf to something else and try.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.