2

I am trying to join a Linux server to Active Directory. I want to set OS Name and OS Version attributes upon joining the domain using this command:

/usr/bin/net ads join -k -S adserver.example.local osName=CentOS osVer=6.5

I've delegated permissions to a bind account so that it can read/write to OS Name and OS Version properties for computer objects. When I try to join domain, I am hit with this error:

Failed to join domain: failed to set machine os attributes: Insufficient access

I have no issues joining the domain when leaving off osName and osVer. Just to verify that this account has the right permissions, I manually set these two properties on the computer objects using ADSI.

1

It's usually easier to pre-stage the computer account, and assign permissions/owner to the account that will be joining it to the domain.

  • I've automated the process from the Linux side and what you described sounds a lot more complicated than what is currently working. – Python Novice Aug 12 '15 at 10:18
  • From a security perspective, it's safer to have a separate computer account prestage process/web service than using a shared provisioning account with elevated permissions in the domain/forest that probably has the credentials saved in a config file. – Greg Askew Aug 12 '15 at 11:51
0

From packet analysis, learned that the account being used to join the domain was missing permissions to read/write to Operating System Service Pack. That attribute was automatically being set to the version of samba that was installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.