Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've configured a Fedora 11 installation to join our domain. It seems to join successfully (though it reports a DNS update failure) but when I try to access \\ I'm prompted for a password. So I enter adminuser and the password and that fails, so I try\adminuser and that too fails. What am I missing?

EDIT (Update 9/1/09): I can now connect to the machine and see the shares on it (see my response to djhowell's answer) but when I try to connect, I get an error saying The network path was not found. I checked the log entry on the Fedora computer for the computer I'm connecting from (/var/log/samba/log.ComputerX) and it reads:

[2009/09/01 12:02:46,  1] libads/cldap.c:recv_cldap_netlogon(157)
    no reply received to cldap netlogon
[2009/09/01 12:02:46,  1] libads/ldap.c:ads_find_dc(417)
    ads_find_dc: failed to find a valid DC on our site (Default-First-Site-Name), trying to find another DC

Config files as of 9/1/09:


Workgroup = TEST
password server = DC.TEST.MYCOMPANY.COM
security = DOMAIN
server string = Test Samba Server
log file = /var/log/samba/log.%m
max log size = 50
idmap uid = 15000-20000
idmap gid = 15000-20000
windbind use default domain = yes
cups options = raw
client use spnego = no
server signing = auto
client signing = auto

comment = Test Share
path = /mnt/storage1
valid users = adminuser
admin users = adminuser
read list = adminuser
write list = adminuser
read only = No

I also set the krb5.conf file to look like this:

default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

default_realm =
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

 kdc =
 admin_server =
 default_domain =

[domain_realm] = =

pam = {
 debug = false
 ticket_lifetime = 36000
 renew_lifetime = 36000
 forwardable = true
 krb4_convert = false

I realize that there might be an issue with EXAMPLE.COM in there, however if I change it to TEST.MYCOMPANY.COM then it fails to join the domain with a preauthentication failure. As of 9/1/09, this is no longer the case.

share|improve this question

From the linux box try:

$ kinit your_username

And enter your password. Then enter:

$ klist

And see if you have a valid kerberos ticket.

In my krb5.conf file I do not have any port numbers in my realms section. Additionally, in the domain_realm section I have something like this:


Try changing the left side of those lines to point directly to the domain controller you're going to authenticate to.

share|improve this answer
I tried kinit, and it said Cannot find KDC for requested realm. So I made the corrections you suggested to my krb5.conf file and fixed the EXAMPLE.COM entry and was successfully able to run kinit, klist and kdestroy. I then redid the net ads join command, which succeeded (except for the "DNS update failed!" message again) and I can now use \\ to browse the shares. However, if I try to open one, I get the message "The network name cannot be found." Now what? – jasonh Aug 26 '09 at 20:55
Try doing a: $ net ads dns register -I <IP of your AD> -U Administrator That may get the DNS error resolved. In regards to the actual share... Double check the path of the share in smb.conf and the permissions of that path. Try setting the permissions to 777 with chmod -R 777 /mnt/path and see if you can access it. You can modify the permissions back to something more restrictive once you figure out if it is indeed a permissions issue. – djhowell Aug 26 '09 at 21:18
The first command didn't go over so well. The result is: ads_connect: No logon servers – jasonh Aug 26 '09 at 21:40
I also tried chmod -R 777 on the mounted path for the share, but that didn't solve the issue accessing the share. – jasonh Aug 26 '09 at 21:45

Sorry for the late reply but maybe I can help someone with the DNS problem once he/she has it. I resolved the DNS problem by adding a mapping to the Fully Qualified DomainName to the address of the Domain Controller such as so:

Domain: DC: HER-PDC

/etc/hosts file:

This resolved the DNS issue for me luckily.

Regards hope it was useful.

share|improve this answer

I would expect that the DNS update failure is your clue here - Windows/Linux (or Unix) interoperability is by no means as seamless as it's sometimes advertised to be. Make sure that your other machines can resolve name-to-IP and IP-to-name for the new box, and if not, add the appropriate DNS records. Then try it and see what happens.

Also worth checking out the IP configuration for the new box to ensure that it's got the correct settings there.

share|improve this answer
Yep, I can ping the Linux machine just fine and the Windows machine resolves the IP address of it, and vice-versa. Both machines can also resolve the IP address of the domain server. – jasonh Aug 26 '09 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.