Talking about renewing keys.
In our setup we use a service account which has the rights to join machines to the domain, the Linux workstations are in s special OU.
I run a cron job which calls msktutil --auto-update every day to renew the machine password if over 30 days.
As discussed in another thread I am not sure if our setup is using adcli autmatically from sssd to renew the machine password.
Yesterday the msktutil failed on one machine, as it looked like the Kerberos ticket for that service account expired.
I did a kinit as that user and everything worked with the msktutil. Password was over 30 days old and it got renewed.
However I am a bit troubled here - surely I do not have to renew the service account ticket every N days also. What a ruddy big faff...