Likewise error when attempting to join Windows domain

[Roasted]

Well, that's not a solution to my issue, as our domain name is quite short. I am receiving this error now:

1225 (0x4C9) ERROR_CONNECTION_REFUSED - Unknown Error.

This is in terminal when I am running sudo domainjoin-cli join domain my_user

EDIT - Found the solution on Likewise forums:

Same thing happened to me on an Ubuntu 10.04 that was renamed, all kinds of nasty lw_errors after that. I couldn’t log in with the GUI or command line. Oddly enough I could log in by starting a ssh session from another host : ssh domainname\\username@host
At first I tried deleting lsass-adcache.db but that wasn’t good enough.

I fixed it by stopping lsassd,
Then removing all the the likewise db files from /var/lib/likewise-open5/db/
Then start lsassd and join the domain again.
No errors this time.

I just hope we don't have to go through that EACH time we join one to the domain. There might be hundreds of systems...

[galen666]

Hi,

I have the same problem as many others. I've tried some fixes but nothing works:

- Upgrading to what I think is the newest version of likewise (6.0.0.8330).
- Editing /etc/nsswitch.conf per https://bugs.launchpad.net/ubuntu/+s...en/+bug/561878
- Patch openldap per http://ubuntuforums.org/showthread.php?t=1613973
- Configuring a static IP
- Check DNS settings (they look fine)
- Tried domainjoin via both cli and gui (same error)
- Checked that the time is in sync (looks right)

My issue seems to be that the client can't find the LDAP server.

I'm running 10.10
uname -ovr
2.6.35-27-generic #48-Ubuntu SMP Tue Feb 22 20:25:46 UTC 2011 GNU/Linux

sudo domainjoin-cli --loglevel info --log . join my.company.domain.com username

Joining to AD Domain: my.company.domain.com
With Computer DNS Name: computername.my.company.domain.com
username@MY.COMPANY.DOMAIN.COM's password:
20110309172806:INFO:Running module join
20110309172806:INFO:Starting krb5.conf configuration (enabling)
20110309172806:INFO:Reading krb5 file /tmp/likewisetmpdHGRjM/etc/krb5.conf
20110309172806:WARNING:Short domain name not specified. Defaulting to 'my'
20110309172806:INFO:Creating krb5 stanza 'appdefaults'
20110309172806:INFO:Writing krb5 file /tmp/likewisetmpdHGRjM/etc/krb5.conf
20110309172806:INFO:File /tmp/likewisetmpdHGRjM/etc/krb5.conf modified
20110309172806:INFO:Finishing krb5.conf configuration
Error: Lsass Error [code 0x00080047]
40286 (0x9D5E) LW_ERROR_LDAP_SERVER_DOWN - Unknown error
20110309172807:ERROR:Lsass Error [CENTERROR_DOMAINJOIN_LSASS_ERROR]
40286 (0x9D5E) LW_ERROR_LDAP_SERVER_DOWN - Unknown error
Stack Trace:
main.c:938
main.c:479
djmodule.c:323
djauthinfo.c:843
djauthinfo.c:1187

Any suggestions?

[hooks]

I had issues with Likewise for a long while as well and, after lots of searching and reading through posts, I finally got Likewise Open AND Likewise CIFS - the file server from Likewise that works with Likewise Open - to work together.

Long story short...

1. Don't use the Ubuntu repositories to install Likewise. Download it from the Likewise site.
2. Edit /etc/hosts and /etc/nsswitch
3. Join with the command line utility

/opt/likewise/bin/domainjoin-cli join [FQDN of your Domain] [Domain Admin Account Name]

4. Set /etc/init.d/srvsvcd to start automatically

sudo update-rc.d -f srvsvcd defaults

5. Create a startup script in /etc/init.d and have it run the Likewise DNS updater program, and make the script run on startup as well with update-rc.d

#!/bin/bash
/opt/likewise/bin/lw-update-dns

6. Create the share from the management console of a Windows machine as the Domain Admin

If you want more detail, check out the post on my blog: http://lordandhooks.com/blog/playing...ise-open-cifs/

[galen666]

Dunno if it makes a difference, but I'm installing 6.0

I had installed this from Likewise before, but looks like I installed LikewiseOpen-6.0.0.8330-linux-x86_64-rpm instead of the Debian/Ubuntu one. Anyway, I downloaded LikewiseOpen-6.0.0.8336-linux-amd64-deb this time and installed it:

sudo Downloads/LikewiseOpen-6.0.0.8336-linux-amd64-deb.sh

..creating directory, verifying archive, uncompressing, checking setup environment

Do you accept the terms of these licenses? (yes/no)
yes
License accepted.
Would you like to install now? (yes/no)
yes
Install started
You have the likewise-open package from Ubuntu installed.
Upgrading from the likewise-open package is not supported.

It isn't getting installed in /opt. The only version on my system is /usr/bin/domainjoin-cli. I have to wonder if this is getting installed at all.

I did have to fix some links:
sudo ln -fs /usr/lib/liblber-2.4.so.2 /usr/local/lib/
sudo ln -fs /usr/lib/libldap_r-2.4.so.2 /usr/local/lib/

..which resolved an error I was getting "domainjoin-cli: /usr/local/lib/liblber-2.4.so.2: no version information available (required by /usr/lib/likewise-open/libnetapi.so.0)"

Unfortunately it still is not working. Maybe adding the domain controller IP address to the hosts file had an effect, but I'm getting a slightly different error now.

Joining to AD Domain: my.company.domain.com
With Computer DNS Name: computer.my.company.domain.com
username@MY.COMPANY.DOMAIN.COM's password:
20110329133522:INFO:Running module join
20110329133523:INFO:Starting krb5.conf configuration (enabling)
20110329133523:INFO:Creating blank krb5.conf
20110329133523:INFO:Reading krb5 file /tmp/likewisetmpSPbrr5/etc/krb5.conf
20110329133523:WARNING:Short domain name not specified. Defaulting to 'my'
20110329133523:INFO:Creating krb5 stanza 'libdefaults'
20110329133523:INFO:Creating krb5 stanza 'domain_realm'
20110329133523:INFO:Creating krb5 stanza 'realms'
20110329133523:INFO:Creating krb5 stanza 'appdefaults'
20110329133523:INFO:Writing krb5 file /tmp/likewisetmpSPbrr5/etc/krb5.conf
20110329133523:INFO:File /tmp/likewisetmpSPbrr5/etc/krb5.conf modified
20110329133523:INFO:Finishing krb5.conf configuration
Error: Lsass Error [code 0x00080047]
2453 (0x995) NERR_DCNotFound - Unknown error
20110329133523:ERROR:Lsass Error [CENTERROR_DOMAINJOIN_LSASS_ERROR]
2453 (0x995) NERR_DCNotFound - Unknown error
Stack Trace:
main.c:938
main.c:479
djmodule.c:323
djauthinfo.c:843
djauthinfo.c:1187

Instead of getting LDAP server down, now I'm getting DC not found.

[atworkwithjf]

It would appear from your post that the repository version is installed as well as the 6.0 version.

You need to remove the repository version using the synaptic package manager first and then you can install LikewiseOpen-6.0

If the repository version is present you will not have a successful install of 6.0.

[galen666]

OK I see now that I was misreading the message I got after trying to install Likewise. I thought it said you successfully installed the software, but it was trying to tell me I had a previous version installed and was not allowed to upgrade from that version to this one.

Anyway, I uninstalled 5.4 and installed 6.0 successfully. However I still can't get domainjoin to work. It takes about 20 seconds now until I get the error below.

sudo domainjoin-cli --loglevel info --logfile . join my.company.domain.com username

<lots of messages, no errors, then...>

20110330111957:INFO:Running module join
Error: LW_ERROR_LDAP_CONSTRAINT_VIOLATION [code 0x00009d7b]

20110330112052:ERROR:LW_ERROR_LDAP_CONSTRAINT_VIOL ATION [LW_ERROR_LDAP_CONSTRAINT_VIOLATION]

Stack Trace:
/builder/src-buildserver/Platform-6.0/src/linux/domainjoin/domainjoin-cli/src/main.c:958
/builder/src-buildserver/Platform-6.0/src/linux/domainjoin/domainjoin-cli/src/main.c:514
/builder/src-buildserver/Platform-6.0/src/linux/domainjoin/libdomainjoin/src/djmodule.c:332
/builder/src-buildserver/Platform-6.0/src/linux/domainjoin/libdomainjoin/src/djauthinfo.c:723
/builder/src-buildserver/Platform-6.0/src/linux/domainjoin/libdomainjoin/src/djauthinfo.c:1140

FYI, my version of libldap:
dpkg --list | grep -i 'libldap'
ii libldap-2.4-2 2.4.23-0ubuntu3.4 OpenLDAP libraries

I found a message that said this happens when you don't have sufficient permissions to join a machine to the domain. However, I do this all the time with this account if the computer is running Windows. This isn't a test network, it is a company network and they do allow people to join laptops, etc. to the domain using their domain credentials.

[atworkwithjf]

It would appear that you already have a machine object in AD for which this user does not have permission to make some modification. There's a host of parameters it may want to modify and cannot do so.

One way to validate this would be to either perform the join the domain with the Administrator account in AD or to delete the machine account and retry the join.

[galen666]

I see what you mean. Based on the LDAP error codes. More info here.

I think I've run into something similar before when trying to rejoin a domain with the same machine name after installing a new OS. I might be able to work around it simply by changing the machine name.

OK this worked.

sudo vi /etc/hostname

<picked a new hostname>

sudo domainjoin-cli --loglevel info --logfile . join my.company.domain.com username

<about 90 seconds of waiting, then lots of messages followed by the important one:>

SUCCESS

I should have left the domain before formatting the drive and installing Ubuntu. It isn't critical at this point, but I could probably get my old hostname joined by using it on another computer then joining and leaving the domain, then leaving and joining again with this one. Not worth the trouble though.

Thanks for all your help atworkwithjf!

[atworkwithjf]

Hey not a problem, that's what we're here for.

One cool thing you can do with new systems before you perform the domainjoin is to se the setname option:

> sudo /opt/likewise/bin/domainjoin-cli setname MYHOSTNAME

This will properly configure your hostname prior to join and can save you the step of manually setting it using the network manager or editing the conf files.

[Neill_R]

bump