Using Winbind to Resolve Active Directory Accounts in Debian

Michael Battista


Table of Contents
1. Introduction
2. Install the Software
3. Stop the Services
4. Configure Kerberos
5. Configure NTP
6. Configure Winbind
7. Configure Nsswitch
8. Join the Domain
9. Start the Services
10. Check Name Resolution
11. Configure PAM
12. Conclusion

1. Introduction

I recently was assigned the task of joining a Debian workstation to a Windows Server 2003 Active Directory domain. Though most of the documentation I read for doing this was rather straightforward, 100% of that documentation turned out to be only 85% useful. While all were easy to follow, at the end of the day I found myself piecing together bits of information from all different sources. Only after deciphering cryptic log messages, consulting my colleagues, and experimenting did I finally have this working. Here I try to provide a complete walkthrough of this procedure, paying close attention to the often overlooked details I encountered in my trials.

Note

The procedure described in this article was performed on a Debian-based system using a Windows Server 2003 domain controller (PDC). Therefore, some of the details in this article (package names, file locations, commands) mentioned here may be inconsistent with those of your distribution. Consult your system's documentation for these details.