0

I'm getting the following error attaching a new CentOS 7 machine to a Windows domain.

[root@centos samba]# net ads join -U administrator
Enter administrator's password:
Using short domain name -- SUBDOMAIN
Joined 'centos' to dns domain 'SUBDOMAIN.FULLDOMAIN.com'
DNS update failed: NT_STATUS_UNSUCCESSFUL

In the link below it's suggested to "verify if dynamic DNS updates are working on your Samba domain controller". How do I do that on Windows Server 2008?

https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members#DNS_Update_failed:_ERROR_DNS_UPDATE_FAILED

  • Does the CentOS server you are adding already have a record created for it in DNS (i.e. manually)? – Mintra Nov 16 '17 at 22:10
  • Thanks for the assist, but we went with another solution. It did have the DNS record, in any case. – Christopher Hostage Nov 16 '17 at 22:48
  • Thought so - that can cause this message. I'll post an answer for reference even though you already worked around. – Mintra Nov 20 '17 at 9:16
1

If the member you are joining already has a record created in the Windows DNS server (because you did it when you first built the machine or whatever), and the DNS server is AD-integrated, you will usually see this message.

This is because Windows DNS by default requires secure dynamic updates when it is integrated to AD. This effectively applies some NTFS-style permissions to each DNS record. Normally when a machine is joined, it dynamically creates its DNS record with its own machine account as the owner and suitable permissions. These permissions allow updates from only that machine (and admins), so prevent other machines modifying the record via the dynamic update mechanism.

When you pre-create the record, you create a record where only the administrator/server has permission to change it and the machine-specific permission is missing (the machine account doesn't even exist at this point). When Samba completes the join, it goes to register the hostname in DNS and finds it can't as it has no permission.

Long story short, you can usually ignore the message if you have already created the A record.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.