OK - not Windows 11 - but Server 2022…
Going to hijack this thread rather than start a new one to rant
I’ve installed it 3 times (Svr 2022 in VirtualBox) - what I’m trying to do is setup an Active Directory DC (domain controller)… But even when I setup a new tree - it won’t run 'cause it’s not activated - pezzo di merda!
Why I hear you ask? Because I really need to get my head around SSSD (System Security Services Daemon) - because it invariably almost always never works when I try to get it working from scratch on garbage like RHEL 8 and 9 servers (I really kinda hate them - would prefer a Ubuntu or a Debian for a server O/S).
I managed it once on RHEL7, and once on Ubuntu 18 (server) - in other environments. In both cases, once I got it working - I created VMware (vSphere / vCenter / ESX) templates to deploy new servers from. In both cases, I did so many things, I don’t actually know for sure, what I did to make it work - it just worked.
It’s one of those things that are so fiddly - when it works it seems like black magic (and you don’t know how you got it to work in the first place)… And when it doesn’t, “bad juju” (I used to use that analogy for Bluetooth on Linux too - but - I must say BlueTooth on Linux - so long has you have a decent chipset [e.g. Intel and not that RealTek garbage] is vastly better than it was say 5-10 years ago!).
I think it’s all the things like pam.d and oddjobd that need to be tweaked - mostly pam.d.
The guides at Red Hat are zero use - they just assume (e.g. here Chapter 1. Connecting RHEL systems directly to AD using SSSD Red Hat Enterprise Linux 8 | Red Hat Customer Portal) :
update-crypto-policies --set DEFAULT:AD-SUPPORT
then :
yum install samba-common-tools realmd oddjob oddjob-mkhomedir sssd adcli krb5-workstation
then :
realm discover domain.org
realm join domain.org
In my case it might be :
realm join -U myDomainAdminAccount domain.org
(and the account I’m using is a Domain Admin)
In my recent experience, customer was DEMANDING AD integration for a pair of consultants to some RHEL 8 virtual servers I’d stood up (and to make matters worse, there’s at least 3 other companies, besides the customer itself in the mix, and my company didn’t do the detailed design and that design made zero mention of AD integration - something that has NEVER been done (AFAIK) at this customer. The no doubt, high paid “architect” of the detailed design didn’t even include any of the networking information - just IP address (no DNS information, no gateway, no netmask).
So I don’t even know if the pre-requisites have even been done in AD to allow this :
Prerequisites
- You are logged into AD as a user who can edit group policies.
- The
Group Policy Management Console
is installed on the computer.
Procedure
- Open the
Group Policy Management Console
.
- Right-click
Default Domain Policy
, and select Edit
. The Group Policy Management Editor
opens.
- Navigate to
Computer Configuration
→ Policies
→ Windows Settings
→ Security Settings
→ Local Policies
→ Security Options
.
- Double-click the
Network security: Configure encryption types allowed for Kerberos
policy.
- Select
AES256_HMAC_SHA1
and, optionally, Future encryption types
.
- Click OK.
- Close the
Group Policy Management Editor
.
- Repeat the steps for the
Default Domain Controller Policy
.
- Wait until the Windows domain controllers (DC) applied the group policy automatically. Alternatively, to apply the GPO manually on a DC, enter the following command using an account that has administrator permissions:
C:\> **gpupdate /force /target:computer**
And they had me busting my balls trying to get this done ASAP super urgent - and then I find out by accident - two of the VMs are in the DMZ and “there is NO AD in the DMZ!” Faahk! - civil servants and numpty “management consultants”…
Seriously - worst environment and customer I’ve worked with in 10+ years or so…