From Fedora Project Wiki

Revision as of 07:38, 18 April 2013 by Stefw (talk | contribs) (Categories)

Description

Leave an active directory domain by removing the computer account, and then deconfiguring locally.

Setup

  1. Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
  2. Run through the test case to join the domain.
  3. Verify that you are joined to the domain with the following command
    $ realm list
    Make sure you have a configured: kerberos-membership line in the output.
    Note the login-formats: line.
  4. Check that you can resolve domain accounts on the local computer.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
    $ getent passwd 'AD\User'

How to test

  1. Perform the leave command.
    $ realm leave --remove --user=User ad.example.com
    You will be prompted for Policy Kit authorization.
    You will be prompted for a password.
    This can take a minute or two depending on how far away you are from the directory.
    On a successful leave there will be no output.

Expected Results

  1. Check that the domain is no longer configured.
    $ realm list
    Make sure the domain is not listed.
  2. Check that you cannot resolve domain accounts on the local computer.
    $ getent passwd 'AD\User'
    There should be no output.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
  3. Check that there is no machine account for the domain in the keytab.
    sudo klist -k
    You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
  4. If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was deleted.



Troubleshooting

Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --remove --user=User --verbose ad.example.com

Known Issue [Selinux]: You need to turn off selinux to complete the join. Please do:

$ sudo setenforce 0

Please file the all realmd AVC's at this bug: https://bugzilla.redhat.com/show_bug.cgi?id=867873

$ sudo grep realmd /var/log/audit/audit.log