Ubuntu – ‘net ads join -U username’ failing with an error ‘NT_STATUS_IO_TIMEOUT’

active-directorykerberosntpsambaUbuntu

I am attempting to provide access to Ubuntu shared directories using Active Directory users and group using Samba. I am following this article to install and configure AD and Unix so that access can be provided:

Summary

  1. As a part of the installation, I have installed ntp krb5-user samba(v4.1.6) samba-common smbclient winbind

  2. I followed the configuration settings as provided in the above article. I have configured ntp.conf, resolv.conf, krb5.conf, nsswitch.conf and smb.conf.

  3. After restarting all of the services and while joining the domain using sudo net ads join -U administrator, I am getting the following error:

    Failed to join domain: failed to lookup DC info for domain 'CELESTIAL1' over rpc: NT_STATUS_IO_TIMEOUT

Testing

  1. I tried to execute kinit username, the ticket got generated successfully and I was able to verify from command 'klist'.

  2. I am able to ping the Ubuntu server's IP and the Windows server's IP as well as the domain from both the sides.

  3. The services winbind, nmbd, and smbd are running as expected.

  4. I rebooted the Ubuntu machine and AD server, but same error is showing while performing the domain join operation.

Questions

  1. What does the NT_STATUS_IO_TIMEOUT error indicate? Are there any issues on the Windows Server or on Ubuntu machine?

  2. How can I join the Ubuntu machine to Active Directory? Are there any steps that I missed that need to be performed to join the domain successfully?

Best Answer

The issue was that there was no entry in /etc/resolv.conf for AD DNS and hence the machine was pinging to the actual global registered domain. On each reboot, the resolv.conf entries gets reset hence we have to provide entry once the system is rebooted.

Related Question