Ubuntu Unable to Join Active Directory: Troubleshooting Guide
In this article, we will discuss the common issues that may arise when attempting to join an Ubuntu system to an Active Directory (AD) domain and provide solutions to troubleshoot these issues. Joining an Ubuntu system to a domain is necessary for centralized authentication and identity management. However, the process is not always straightforward, and errors may occur.
Issue 1: Incorrect Domain Name
The first common issue is entering an incorrect domain name during the domain join process. This may result in the following error message:
sudo realm join domain.com
Output:
Realm: domain.com
Type: kerberos
Domain controller: dc1.domain.com
Failed to join the realm: Invalid domain name
To resolve this issue, verify the spelling and case of the domain name and try again. Ensure that you are using the fully qualified domain name (FQDN) and not just the NetBIOS name.
Issue 2: DNS Configuration
Proper DNS configuration is crucial for successful domain join. If the Ubuntu system is not able to resolve the domain name or find the domain controller, the domain join process will fail. You can check the DNS configuration using the following command:
cat /etc/resolv.conf
Output:
nameserver 192.168.1.1
search domain.com
Ensure that the correct nameserver and search domain are configured. You can also check the DNS resolution manually:
nslookup dc1.domain.com
Output:
Server: 192.168.1.1
Address: 192.168.1.1#53
Name: dc1.domain.com
Address: 192.168.1.50
If the DNS resolution is not working, you may need to update the DNS settings or check the network configuration.
Issue 3: Time Synchronization
Active Directory relies on Kerberos for authentication, and Kerberos relies on accurate time synchronization between the clients and the domain controllers. If the time on the Ubuntu system is not synchronized with the domain controller, the domain join process will fail. You can check the time synchronization using the following command:
timedatectl
Output:
Local time: Sat 2023-03-11 12:34:56 EST
Universal time: Sat 2023-03-11 17:34:56 UTC
RTC time: Sat 2023-03-11 12:34:56
Time zone: America/New\_York (EST, -0500)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no
Ensure that the system clock is synchronized with the NTP service.
Issue 4: Firewall Configuration
The firewall configuration on both the Ubuntu system and the domain controllers may block the necessary ports for domain join. By default, Ubuntu uses the Uncomplicated Firewall (UFW) to manage the firewall rules. You can check the status of the firewall using the following command:
sudo ufw status
Output:
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
139/tcp ALLOW Anywhere
139/udp ALLOW Anywhere
445/tcp ALLOW Anywhere
445/udp ALLOW Anywhere
636/tcp ALLOW Anywhere
636/udp ALLOW Anywhere
389/tcp ALLOW Anywhere
389/udp ALLOW Anywhere
Ensure that the necessary ports for domain join are open, including TCP/UDP ports 139, 445, 389, 636, and 88.
- Verify the domain name spelling and case
- Check the DNS configuration and resolution
- Ensure accurate time synchronization
- Configure the firewall rules to allow necessary ports for domain join