I am trying to join a Ubuntu/Linux computer to the Active Directory domain as a normal user-account who is not a member of the domain-admins group.

I can join Windows computers just fine. You do not have to be admin, but have a quota of computers that you can join without being an administrator.

But when I try to bring a Ubuntu Linux computer into the domain, it fails with the error message below. I would appreciate any help on this.

daniel@linux01:~$ sudo realm join -v -U '[email protected]' AD.example.com
[sudo] password for daniel:
 * Resolving: _ldap._tcp.ad.example.com
 * Performing LDAP DSE lookup on:
 * Successfully discovered: ad.example.com
Password for [email protected]:
 * Unconditionally checking packages
 * Resolving required packages
 * LANG=C /usr/sbin/adcli join --verbose --domain ad.example.com --domain-realm AD.example.com --domain-controller --login-type user --login-user [email protected] --stdin-password
 * Using domain name: ad.example.com
 * Calculated computer account name from fqdn: LINUX01
 * Using domain realm: ad.example.com
 * Sending NetLogon ping to domain controller:
 * Received NetLogon info from: dc1.ad.example.com
 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-iIuXdP/krb5.d/adcli-krb5-conf-eeT5bO
 * Authenticated as user: [email protected]
 * Looked up short domain name: AD
 * Looked up domain SID: S-1-5-21-13313029-848207003-2406435418
 * Using fully qualified name: linux01.ad.example.com
 * Using domain name: ad.example.com
 * Using computer account name: LINUX01
 * Using domain realm: ad.example.com
 * Calculated computer account name from fqdn: LINUX01
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Computer account for LINUX01$ does not exist
 * Found well known computer container at: CN=Computers,DC=ad,DC=example,DC=com
 * Calculated computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com
 * Encryption type [3] not permitted.
 * Encryption type [1] not permitted.
 ! Insufficient permissions to modify computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com: 000020E7: AtrErr: DSID-03153402, #1:
        0: 000020E7: DSID-03153402, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

adcli: joining domain ad.example.com failed: Insufficient permissions to modify computer account: CN=LINUX01,CN=Computers,DC=ad,DC=example,DC=com: 000020E7: AtrErr: DSID-03153402, #1:
        0: 000020E7: DSID-03153402, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

 ! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain

2 Answers 2


You're not providing any Container Name (CN in the error messages) so the Linux01 machine is inserted into the default "Computers" CN. My guess is that your user account hasn't enough privilege to alter this CN, or more probably it doesn't even exist in your AD, so that you must provide a complete CN path.

In Windows, when adding a computer to the AD the GUI allows you to navigate the Domain tree and select the appropriate container (leaf). You should probably add an entry in your realm.conf file, or add the OU information directly to the command line.

/etc/realmd.conf defaults:

computer-ou = OU=Linux Computers,DC=AD,DC=example,DC=com
# computer-ou = OU=Linux Computers,

On the command line:

realm join [email protected] AD.example.com --computer-ou='Linux ComputersDC=AD,DC=example,DC=com'

First find the OU/CN with ldapsearch :

ldapsearch -LLL -H ldap://AD.example.com -b adc,dc=example,dc=com -D 'AD\daniel'  -W '(name=web_servers)' dn
  • Thanks for your response, but Found well known computer container at: CN=Computers,DC=ad,DC=example,DC=com
    – Daniel
    Mar 12, 2020 at 19:43
  • 1
    This is the default in the realmd.conf config file, that's why it seems dubious to me. This is a catch-all, and nothing proves that your user has enough rights to modify it.
    – wazoox
    Mar 13, 2020 at 20:34
  • 1
    But not accurate. I joined one client prior to attempting the linux client.
    – Daniel
    Mar 13, 2020 at 22:56
  • 1
    Then your AD may be running Windows 2008 or 2008R2. adcli creates accounts through LDAP, and that fails with these windows versions (versions of AD and client are definitely important).
    – wazoox
    Mar 13, 2020 at 23:15
  • 3
    @Daniel MS documentation never mentions LDAP, but it uses LDAP all the same. As you're systematically hostile, you can sort it out by yourself, mate, I don't feel like helping you anymore. Try being nice next time, uh?
    – wazoox
    Oct 28, 2020 at 14:31

I had the exact same issue, and it turned out that there are more permissions required to join a Linux system than a Windows system to the domain, though I'm not sure why that is the case.

I added additional permissions to my domain join account following this guide: https://www.computertechblog.com/active-directory-permissions-required-to-join-linux-and-windows-computers-to-a-domain/

From the above link:

Standard permissions required to join systems to AD (Linux and Windows)

  • Reset password
  • Read and write account restrictions
  • Validated write to DNS host name
  • Validated write to service principal name
  • Read and write DNS host name attributes

Additional permissions required by Linux machines to join AD (Linux)

  • Read dNSHostName
  • Write dNSHostName
  • Read msDS-AddtionalSamAccountName
  • Write msDS-AddtionalSamAccountName
  • Read msDS-SupportedEncryptionTypes
  • Write msDS-SupportedEncryptionTypes
  • Read Operating System
  • Write Operating System
  • Read Operating System Version
  • Write Operating System Version
  • Read OperatingSystemServicePack
  • Write OperatingSystemServicePack
  • Read servicePrincipalName
  • Write servicePrincipalName
  • Read userAccountControl
  • Write userAccountControl
  • Read userPrincipal Name
  • Write userPrincipal Name

NOTE: You must show "Property-specific" permissions to see these extra permissions.


  • 1
    Thanks for the reply, but for being marked as an answer, something is missing. Why do you have to give a user account all those permissions for it being able to join a Linux machine, but you don't have to that before using it to join a Windows machine?
    – Daniel
    Sep 9, 2020 at 6:46
  • 2
    I really have no clue, doesn't make much sense to me. It did solve the issue for me though. I am guessing that Windows machines themselves are able to write into those fields once they join the domain using their computer account, but linux machines cannot? That is just a guess. I just followed the advice here: computertechblog.com/…
    – jgstew
    Sep 10, 2020 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .