[Samba] Confirmed inconsistency between `samba-tool domain join` and `net ads join`

Patrick Goetz pgoetz at math.utexas.edu
Thu Nov 4 10:14:28 UTC 2021


OK, was able to confirm that samba-tool at best inconsistently updates 
DNS when a machine joins the domain:

root at atomsmasher:~# samba-tool domain join ea.linuxcs.com MEMBER -U 
administrator
Password for [EA\administrator]:
Joined domain ea.linuxcs.com (S-1-5-21-2398640129-655337111-1434392923)


root at samba-dc:~# host atomsmasher
root at samba-dc:~#


root at atomsmasher:~# net ads leave -U Administrator
Password for [EA\Administrator]:
Deleted account for 'ATOMSMASHER' in realm 'EA.LINUXCS.COM'
root at atomsmasher:~# samba-tool domain join ea.linuxcs.com MEMBER -U 
administrator
Password for [EA\administrator]:
Joined domain ea.linuxcs.com (S-1-5-21-2398640129-655337111-1434392923)


root at samba-dc:~# host atomsmasher
root at samba-dc:~#

root at atomsmasher:~# net ads leave -U Administrator
Password for [EA\Administrator]:
Deleted account for 'ATOMSMASHER' in realm 'EA.LINUXCS.COM'
root at atomsmasher:~# net ads join -U administrator
Password for [EA\administrator]:
Using short domain name -- EA
Joined 'ATOMSMASHER' to dns domain 'ea.linuxcs.com'


root at samba-dc:~# host atomsmasher
atomsmasher.ea.linuxcs.com has address 192.168.1.82


Also confirmed that the DNS entry is not removed when the machine leaves 
the domain. As mentioned previously, if the DNS entry is created 
automatically, then it also needs to be removed automatically. Since 
it's automatic, it's not inconvenient to the admin who takes a machine 
out of the domain and adds it back soon thereafter.  Also, consequences:

root at atomsmasher:~# net ads join -U administrator
Password for [EA\administrator]:
Using short domain name -- EA
Joined 'ATOMSMASHER' to dns domain 'ea.linuxcs.com'
DNS Update for atomsmasher.ea.linuxcs.com failed: ERROR_DNS_UPDATE_FAILED
DNS update failed: NT_STATUS_UNSUCCESSFUL


The PTR record is not added automatically:

root at samba-dc:~# samba-tool dns query samba-dc ea.linuxcs.com 
atomsmasher PTR -UAdministrator
Password for [EA\Administrator]:
   Name=, Records=0, Children=0

If the A record is added automatically, the PTR record probably should 
be too.  This would be consistent with Windows servers' behavior.



More information about the samba mailing list