We're joining our Linux machines to our Active Directory using adcli join. Now we start doing this as part of our saltstack setup, but we cannot figure out how to determine if the machine is already joined to the domain? It seems nothing breaks by doing multiple joins, but it does take some time and seems a bit unclean. What can we look at to find if the machine is already joined? Nothing in the adcli suite seems to do the trick.

Linux distro used is CentOS (both 6.6 and 7), domain is 2008R2 functional level.

EDIT: I've seen some people checking for the existence of /etc/krb5.keytab, but it seems to me that that is only indicative if the machine has ever been joined. If I remove the machine account from the AD, the file will still be there, but the machine is in fact no longer joined.

  • Could you run ldapsearch against your Active Directory? I don't have AD in my environment to test this with, but it seems you should be able to write a query that would search for your machine's ID. – Joe Block Jul 6 '15 at 0:50

A successful kinit -k host/$(hostname -f) should be sufficient.

This checks to see both if the keytab exists and is valid.

|improve this answer|||||
  • This works for checking if joined to FreeIPA servers as well – Azifor May 17 '17 at 19:20

I think you could just check the return code of the following command:

realm list | grep active-directory

It should return 1 if there are no domains connected.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.