-1

My Linux server is getting disconnected from windows DC for every 30 days. Not sure where I need to check either AD or Linux sever config files

closed as too broad by Greg Askew, Thomas, Jenny D, Patrick Mevzek, Tommiie Jun 13 at 13:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

Hi this occurs when the maximum machine account password age expires.

It sounds like you're running into an issue with the default SSSD-AD value for ad_maximum_machine_account_password_age of 30 days before attempting a renew which is greater than what your domain policy is set to. Try dropping the ad_maximum_machine_account_password_age flag to 15 or 10 days depending on personal preference.

It is also important to run RSOP to determine what value actually is for your domain.

Here is some appropriate reading to help confirm this statement and address the relevant required config.

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age

https://funinit.wordpress.com/2017/11/29/how-sssd-updates-machine-account-password/

http://manpages.ubuntu.com/manpages/xenial/man5/sssd-ad.5.html

  • I couldn't file any configuration file like sssd-ad under sssd direcotry. All I see is only sssd.conf file... – Godwin May 30 at 8:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.