Hi Team,
Sorry for the late reply. We are really confused about the behaviour of sssd. We have one machine whose net ads testjoin shows join failed but still I am able to authenticate via my AD ID. Can you help us why is it happening ? It present us to the confusion as what is really right configuration that will remain persistent and not break AD authentication even after server reboot. Below are the output of some important files but do let me know if you need some extra information.
net ads test join output
```
kerberos_kinit_password example1$@AD.ADMIN failed: Preauthentication failed
kerberos_kinit_password example1$@AD.ADMIN failed: Preauthentication failed
Join to domain is not valid: Logon failure
```
smb.conf
```
[global]
workgroup = ADADMIN
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
log file = /var/log/samba/%m.log
realm = AD.ADMIN
security = ads
netbios name = example1
disable netbios = yes
log file = /var/log/samba/log.%m
max log size = 50
load printers = yes
cups options = raw
[homes]
comment = Home Directories
browseable = no
writable = yes
[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
guest ok = no
writable = no
printable = yes
```
sssd.conf
```
[sssd]
services = nss, pam
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
domains = ad.admin
[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3[pam]reconnection_retries = 3
[domain/ad.admin]
id_provider = ad
cache_credentials = True
access_provider = simple
ldap_id_mapping = True
use_fully_qualified_names = False
ad_domain = ad.admin
enumerate = false
ldap_deref_threshold = 0
ldap_use_tokengroups = False
debug_level = 3
[autofs]
```
krb5.conf
```
logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = AD.ADMIN
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
```
Regards
Sachin Kumar