0

Why am I being told I have insufficient permission despite my user being a member of AAD DC Administrators in Azure - Which I believe is the requirement for updating computer accounts

Followed the official instructions here: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-join-ubuntu-linux-vm

Eventually I worked out that I needed to add my users to that group

When I finally run sudo realm join --verbose CONTOSO100.COM -U 'bob@CONTOSO100.COM' --install=/

Calculated computer account: CN=CONTOSO-UBUNTU,OU=AADDC Computers,DC= 
contoso100,DC=com
! Insufficient permissions to modify computer account: CN=CONTOSO- 
UBUNTU,OU=AADDC Computers,DC= contoso100,DC=com: 000020E7: AtrErr: 
DSID-031530D8, #1:
0: 000020E7: DSID-031530D8, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, 
Att 90008 (userAccountControl):len 4
adcli: joining domain contoso100.com failed: Insufficient permissions 
to modify computer account: CN=CONTOSO-UBUNTU,OU=AADDC Computers,DC= 
contoso100,DC=com: 000020E7: AtrErr: DSID-031530D8, #1:
0: 000020E7: DSID-031530D8, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, 
Att 90008 (userAccountControl):len 4

! Insufficient permissions to join the domain
realm: Couldn't join realm: Insufficient permissions to join the domain

Strange things that happened:

When running kinit for a new user it asks for my password But always returns kinit: Preauthentication failed while getting initial credentials

If I enter a blank password it says password expired and allows me to enter a new one. After this I can authenticate with the new password but this password is now not the same password I used to log into azure. Which says to me I can't even be sure its the same linked user. But it is definitely checking AD for my user accounts because it will tell me it can't find the account if I enter one that doesn't exist

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.