I have tried to setup Samba File Server with AD authentication.

The authentication via Active Directory is successful but if you reboot the server the linux Samba file server will NOT join the domain automatically like windows server do.

You still have to manually join the domain by issue the below command line with user password:

net join ads -U username -S DOMAIN.COM

Is there a way to automate this?

I know I can put a init scripts but the user password will change every 3 months and I don't want to change the scripts every 3 months.

I am looking for something like a windows file server in which after reboot it will still be connected to the domain without any login credential requirements.

Here are my configuration file:

cat /etc/samba/smb.conf

#======================= Global Settings =====================================
workgroup = MYDOMAIN
netbios name = host_name
realm = DOMAIN.COM
password server = dc01.domain.com
security = ads
idmap uid = 100000-200000
idmap gid = 100000-200000
template homedir = /home/%U
template shell = /bin/nologin
winbind use default domain = yes
winbind offline logon = yes
winbind enum users = yes
winbind enum groups = yes
path = /var/windows_share
browseable = yes
writeable = yes
valid users = my_name

cat /etc/krb5.conf

 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
 default_realm = DOMAIN.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
  kdc = dc01.domain.com
  admin_server = dc01.domain.com
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM

cat /etc/nsswitch.conf

passwd: files winbind 
shadow: files winbind 
group: files winbind

Here is the samba log after reboot: (I didn't find any abnormal/error messages in the system logs)

[root@samba_server ~]# wbinfo -t
checking the trust secret for domain DOMAIN_NAME via RPC calls failed
error code was NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND (0xc0000233)
failed to call wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR
Could not check secret

[root@samba_server ~]# cat /var/log/samba/log.winbindd
[2014/04/28 17:37:24.779467,  0] winbindd/winbindd_util.c:330(trustdom_list_done)
  Got invalid trustdom response
[2014/04/28 17:42:24.855052,  0] winbindd/winbindd_util.c:330(trustdom_list_done)
  Got invalid trustdom response
[2014/04/28 17:47:24.856028,  0] winbindd/winbindd_util.c:330(trustdom_list_done)
  Got invalid trustdom response
[2014/04/28 17:47:48.627719,  0] winbindd/winbindd.c:240(winbindd_sig_term_handler)
  Got sig[15] terminate (is_parent=1)
[2014/04/28 17:50:41,  0] winbindd/winbindd.c:1382(main)
  winbindd version 3.6.9-168.el6_5 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2011

[root@samba_server ~]# cat /var/log/samba/log.nmbd
[2014/04/28 17:47:40,  0] nmbd/nmbd.c:66(terminate)
  Got SIGTERM: going down...
[2014/04/28 17:50:44,  0] nmbd/nmbd.c:861(main)
  nmbd version 3.6.9-168.el6_5 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2011
[2014/04/28 17:51:07,  0] nmbd/nmbd_become_lmb.c:397(become_local_master_stage2)

  Samba name server SAMBA_SERVER is now a local master browser for workgroup DOMAIN_NAME on subnet XXX.XXX.XXX.XXX

[root@samba_server]# cat /var/log/samba/log.smbd
[2014/04/28 17:50:44,  0] smbd/server.c:1026(main)
  smbd version 3.6.9-168.el6_5 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2011
[2014/04/28 17:50:45.890687,  0] printing/nt_printing.c:102(nt_printing_init)
  nt_printing_init: error checking published printers: WERR_ACCESS_DENIED
[2014/04/28 17:50:45.911910,  0] printing/print_cups.c:151(cups_connect)
  Unable to connect to CUPS server localhost:631 - Connection refused
[2014/04/28 17:50:45.912696,  0] printing/print_cups.c:528(cups_async_callback)
  failed to retrieve printer list: NT_STATUS_UNSUCCESSFUL

Then I have to manually join the domain after reboot:

[root@samba_server ~]# net join ads -U USER_NAME -S DC01.DOMAIN.COM
Enter User's password:
Joined domain DOMAIN.

2 Answers 2


You shouldn't need to join your Samba host back to the domain every time you reboot! If you've done it correctly, it should just reauthenticate after your services come back up.

Are you getting any errors for smb, winbind or kerberos? I can't view the article you've linked.

It seems likely you've omitted some config step for one of these services.

Also, which platform are you on for Samba? I suggest some basic troubleshooting of the underlying services by starting and stopping them and looking for errors in the logs may help.

On a separate note, and not for automating a task to keep joining the domain over and over, you should get a "service account" with a non-expiring password for your Samba service.

In most environments, if you clearly explain the requirement for the non-expiring password, that it doesn't require any unusual privileges, and that you'll follow due process in maintaining it, then there's usually no problem.

If it's an ultra-secure environment and they won't give you an non-expiring password, or longer expiry interval, then you'll probably just have to deal with reconfiguring it every three months.

  • I have added the configuration file and the guide website is down for the moment.
    – Xianlin
    Apr 17, 2014 at 8:50
  • And where are any logs/errors/messages?
    – LeeM
    Apr 28, 2014 at 5:06
  • added the log but there is no errors in the system log after reboot
    – Xianlin
    Apr 28, 2014 at 10:08
  • Once joined to the domain, create a kerberos keytab (your AD administrators should be able to show you how to do so). This is used in-lieu-of a username and password to authenticate the (SAMBA) application to the domain.
    – DTK
    Dec 23, 2014 at 23:18
  • For those of you want to survive Samba Share Authenticate Against Windows Active Directory after your linux box reboot, please use Ubuntu 14.04 and follow the method here: raymii.org/s/tutorials/… I tested it and after reboot my AD shared folder is still working fine.
    – Xianlin
    Sep 21, 2015 at 6:49

I have been trying to find this also and stumbled upon it. Unfortunately I can't find the source of where I got it but I believe this is happening because winbind is starting after smbd and nmbd. So the trick is to have smbd and nmbd restart after winbind starts. I don't think this is the correct linux admin way, but it works for me

edit /etc/rc.local add
service smbd restart
service nmbd restart

Save and reboot to try it out. Mine worked doing this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .