Join in Active Directory Domain2026/11/12

Join in Windows Active Directory Domain with Realmd.

This tutorial needs Windows Active Directory Domain Service in your Local Network.
This example is based on the environment like follows.

Domain Server	: Windows Server 2025
Domain Name	: srv.world
Hostname	: fd3s.srv.world (10.0.0.100)
NetBIOS Name	: FD3S01
Realm	: SRV.WORLD

[1]

Install required packages.

root@dlp:~#

dnf -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools

[2]	Join in Windows Active Directory Domain.

# change DNS setting to refer to AD

root@dlp:~#

nmcli connection modify enp1s0 ipv4.dns 10.0.0.100

root@dlp:~#

nmcli connection up enp1s0

Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

# discover Active Directory domain

root@dlp:~#

realm discover SRV.WORLD

srv.world
  type: kerberos
  realm-name: SRV.WORLD
  domain-name: srv.world
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: sssd-common
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd-ad
  required-package: adcli
  required-package: samba-common-tools

# join in Active Directory domain

root@dlp:~#

realm join SRV.WORLD

Password for Administrator:   # AD Administrator password
Join is successful!
Please note that by default, you have to use fully-qualified names
during AD user lookup & login instead of just short names
e.g. 'username@domain' instead of just 'username'. Although
fully-qualified names are recommended, this behaviour can be changed
in sssd.conf file with the 'use_fully_qualified_names = False' option.

# verify possible to get an AD user info

root@dlp:~#

id Serverworld@srv.world

uid=918601103(serverworld@srv.world) gid=918600513(domain users@srv.world) groups=918600513(domain users@srv.world),918600572(denied rodc password replication group@srv.world),918600512(domain admins@srv.world)

# verify possible to login as an AD user

root@dlp:~#

exit

logout

Fedora Linux 45 (Server Edition)
Kernel 7.2.15-300.fc45.x86_64 on x86_64 (ttyS0)

Web console: https://dlp.srv.world:9090/ or https://10.0.0.30:9090/

dlp login: Serverworld@srv.world
Password:
serverworld@srv.world@dlp:~$   # logined

[3]	If you'd like to omit domain name for AD user, configure like follows.

root@dlp:~#

vi /etc/sssd/sssd.conf

# line 15 : change

use_fully_qualified_names =

False

root@dlp:~#

systemctl restart sssd

root@dlp:~#

id Administrator

uid=918600500(administrator) gid=918600513(domain users) groups=918600513(domain users),918600572(denied rodc password replication group),918600512(domain admins),918600518(schema admins),918600520(group policy creator owners),918600519(enterprise admins)

[4]

AD users UID/GID are assigned randomly, but if you'd like to assign fixed UID/GID, configure like follows.

Add UNIX attributes to AD accounts first, refer to here.
( To add them by PowerShell on CUI, refer to here of [4] )
This example is based on the environment AD accounts have [uidNumber/gidNumber] attributes.

Next, change SSSD settings.

root@dlp:~#

vi /etc/sssd/sssd.conf

# line 16 : change

ldap_id_mapping =

False

# add to last line

ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber

# clear cache and restart sssd

root@dlp:~#

rm -f /var/lib/sss/db/*

root@dlp:~#

systemctl restart sssd

root@dlp:~#

id Serverworld

uid=2000(serverworld) gid=100(users) groups=100(users)

Matched Content