5

During some troubleshooting I deleted the machine account for a Linux server running samba from our AD 2003 domain. We are using Kerberos for authentication, and after I deleted the machine account I tried to join the domain again using

net ads join -U Administrator

But I keep getting Kerberos errors like these:

[2009/08/18 16:14:36, 0] libads/kerberos.c:ads_kinit_password(228)
     kerberos_kinit_password MACHINE$@MY.DOMAIN.COM failed: Client not found in Kerberos database
 Failed to join domain: Improperly formed account name

It appears as if samba remembers that it once had an account with the AD and keeps trying to reconnect to it, but I want to create a new account from scratch. I tried to delete all the .tdb files I could find as well as everything under /var/cache/samba but to no avail - it still behaves the same.

I also tried to create the machine account on the AD side, but then I get a similar error when I try to join, about failure to authenticate with the machine account - it looks like samba tries the previous machine account password and I don't know how to reset it, or even if I could figure out what samba uses - how to set it in the AD.

Any help would be greatly appreciated, as at this point the only thing I can think about is to reformat and reinstall the machine, and I would really REALLY love to not do that.

Thanks in advance.

1
  • Are you using "." as a winbind separator? If not, have you changed the winbind separator?
    – jneves
    May 5, 2010 at 17:34

4 Answers 4

5

First run a kdestory to remove any reference to the machine account in the local kerberos cache, then manually run kinit administrator@MY.DOMAIN.LOCAL and enter the password.

Then run the net ads join command.

This should give you the kerberos trust to create the machine account without having to try and use the old machine account credentials.

0
0

Have you recreating your .tdb file with the smbpasswd command?

3
  • No - they don't have any interesting passwords that I need to keep so I just delete them and samba recreates them.
    – Guss
    Aug 26, 2009 at 18:35
  • I'm not sure you don't need them. :)
    – kmarsh
    Aug 26, 2009 at 19:38
  • Sorry I do not understand your english... Dec 31, 2018 at 13:32
0

Have you tried running the "net ads leave" command prior to re-joining? It will probably fail on the AD part of it, since the computer account was already deleted on the AD side.

1
  • I did - it reported an error but did not provide any other information nor affected the situation in anyway.
    – Guss
    Sep 8, 2009 at 16:11
0

Do a quick experiment, change samba name in smb.conf to something else and try.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.