How to djoin.exe to create the djoin file and join Unix server using this for kerberos armoring (4380540)

N/A

N/A

Here is a tested working process:

Log in with AD admin account in the Windows server machine and open PowerShell as AD admin, which has permission to DC to write the OU and join the domain, and then run the command:

Sample:

PS C:\Users\sysadm> djoin.exe /reuse /provision /domain arhidm.lab /machine arhdocker /primarydns arhdocker.arhidm.lab /savefile "C:/arhodocker.djoin"

If using separate OU:

djoin.exe /provision /domain domain.com /machine hostname /machineou OU=UNIX,OU=COMPUTERS,OU=XX,DC=XXX,DC=XXX /savefile C:\temp\arhodocker.djoin

Replace with XXX with your domain:

Provisioning the computer...
Successfully provisioned [arhdocker] in the domain [arhidm.lab].
Provisioning data was saved successfully to [C:/arhodocker.djoin].

You can also use your OU I think, as you have shown in the command.

2. Move the djoin file to Linux machine and then run the join command, and it should be successful:

root@arhdocker ~]# vastool join -j arhodocker.djoin

Using djoin file <arhodocker.djoin> to join to domain <arhidm.lab>

Checking whether computer is already joined to a domain ... no
Stopping daemon: vasd ... OK
Configuring forest root ... arhidm.lab ... OK
Configuring site ... Default-First-Site-Name ... OK
Joining computer to the domain as host/arhdocker.arhidm.lab ... OK
Joined using computer object "CN=arhdocker,CN=Computers,DC=arhidm,DC=lab" ... OK
WARNING: Your computer was joined to the domain successfully,
however, some optional attributes could not be set.
This is normal if you have only been delegated rights
to join computers to a domain and not full access
to modify computer attributes
Writing vas.conf ... OK
Populating misc cache ... OK
Preparing to apply Group Policy ... OK
Applying Group Policy Settings ... OK
Starting daemon: vasd ... OK
Caching Users ... OK
Mapping mapped users ... OK
Processing user overrides ... OK
Caching Groups ... OK
Caching Nested Memberships ... OK
Processing group overrides ... OK
Caching Srvinfo ... OK
Caching Netgroups ... OK
Caching Automounts ... OK
Configuring NSS and PAM using authselect ... OK
Starting DNS update service: ipmon ... OK