Joining Active Directory Error

anodos said:

What version is this?

Samuel Tai said:

What's the full version? 12.0 doesn't tell us that much.

Samuel Tai said:

What does the version show in System Information widget in the Dashboard? We're looking for something like 12.0-U7.

Samuel Tai said:

For the domain account name, try just the account without the domain in front. It's probably prepending the domain in front of your domain\account, so of course there won't be an account matching domain\domain\account.

anodos said:

update to U7, there is a critical winbindd security vulnerability in U5, otherwise Samuel Tai is right. Later versions also have better error reporting.

Samuel Tai said:

Are you leaving the \ in front of the account?

Samuel Tai said:

How is your domain set up? This smells like password authentication for Administrator has been disabled.

Also, have you looked at the manual? https://www.truenas.com/docs/core/directoryservices/activedirectory/

You've already stated DNS is working. How about NTP? Are you sync'ed to the DC? Are you using the NetBIOS domain or the DNS domain for your forest?

anodos said:

The particular place you're failing at is when we try to kinit to get a kerberos ticket. You can try to kinit from CLI by running command `kinit administrator@fqdn`. It might give more useful information.

I haven't set up Kerberos or anything tho, should I do that? Kinda new to this stuff.

Samuel Tai said:

AD requires Kerberos. No wonder it's not working. You're just trying to join an ordinary domain.