

I have actually 9.2.7 to run fine in mine environment. Invited 9.3 Stable and lost conductivity to my domain. Saw numerous bugs top top this issue, so ns updated come the latest steady version and also tried again. I deserve to ping domain server. Included windows shares and allowed cifs. I can see the server and view re-superstructure via windows, however can"t authenticate. Trying to load energetic directory service fails to start. I"m in combined 2003/2008 mode and changed the gp info accordingly with no help. I complied with the troubleshooting info and also can view the srv records for the domain controllers. Ns tried the manual commands at the bottom and receive the error below.
You are watching: Host is not configured as a member server
FreeNAS-9.3-STABLE-201412312006
Welcome come FreeNAS
BENSON-FAMILY.LOCAL
Issued Expires PrincipalJan 5 15:24:57 january 6 01:24:57 krbtgt/BENSON-FAMILY.LOCAL
BENSON-FAMILY.LOCAL
History
#1

#2

#3

#4

Can you shot to enable advertisement from the UI, then attach /var/log/messages and /var/log/debug.log come this ticket please?
#5

Attached room log documents you requested.
#6

Stephen Benson wrote:
Attached are log papers you requested.
It"s failing at ix-activedirectory. Deserve to you change /etc/ix.rc.d/ix-activedirectory to have "set -x" at the top? (right after #!/bin/sh). Afterwards, run this native the command line:
sh /etc/directoryservice/ActiveDirectory/ctl start
Post the results to this ticket.
#7

Attached is the record with the calculation from above command.
#8

Stephen Benson wrote:
Attached is the file with the output from over command.
The sign up with is timing out. Have the right to you bump up the timeout worths in your ad config? try setting them in ~ 60 and let me understand if the fixes this.
#9

Looks choose same an outcome with 60 sec. Timeout.
#10

Stephen Benson wrote:
Looks favor same result with 60 sec. Timeout.
The document you"ve enclosed is still set to 10 seconds. Can you verify the both "AD timeout" and "DNS timeout" in your active Directory construction are set to 60?
#11

John Hixson wrote:
Stephen Benson wrote:
Looks prefer same result with 60 sec. Timeout.
The record you"ve enclosed is still collection to 10 seconds. Deserve to you verify that both "AD timeout" and "DNS timeout" in your active Directory construction are set to 60?
And just in case, crank these approximately 60, climate click "Save" however without "enable" being clicked. When it saves, then shot and click "enable" and "save".
#12

According to the gui it shows 60 because that each. Here"s the output again.
#13

I have actually left site name blank in the progressed settings, could these be in search of a website name? I have a home domain setup utilizing default-first-site-name in advertisement Sites and also Services. Likewise don"t have actually a Kerberos Keytab set in advanced. Simply checking various other configs, in 9.2.1.7 I use the basic setup and everything clicks simply fine.
#14

Stephen Benson wrote:
I have left site name empty in the advanced settings, could these be looking for a site name? I have actually a residence domain setup utilizing default-first-site-name in advertisement Sites and also Services. Likewise don"t have a Kerberos Keytab collection in advanced. Just checking various other configs, in 9.2.1.7 I usage the straightforward setup and everything clicks simply fine.
What the paper shows is tho 10 seconds. Have the right to you operation this native the command line and post the calculation to this ticket please?
sqlite3 /data/freenas-v1.db "select ad_timeout, ad_dns_timeout indigenous directoryservice_activedirectory;"
#15

Comes back 60|60
#16

Stephen Benson wrote:
Comes earlier 60|60
Can you affix /etc/directoryservice/ActiveDirectory/config come this ticket?
#17

Config is empty - 0B as soon as opened in notepad.
#18

Stephen Benson wrote:
Config is north - 0B once opened in notepad.
Do this native the command line:
adtool acquire config_file
Post output to this ticket please.
#19

ad_bindname=tsradminad_domainname=benson-family.localad_netbiosname=BENSON-FAMILYad_basedn=DC=benson-family,DC=localad_binddn=tsradmin
BENSON-FAMILY.LOCALad_site=ad_dcname=tsr-dc8r2.benson-family.localad_dchost=tsr-dc8r2.benson-family.localad_dcport=389ad_gcname=tsr-dc8r2.benson-family.localad_gchost=tsr-dc8r2.benson-family.localad_gcport=3268ad_krbname=tsr-dc8r2.benson-family.local:88ad_krbhost=tsr-dc8r2.benson-family.localad_krbport=88ad_kpwdname=tsr-dc8r2.benson-family.local:464ad_kpwdhost=tsr-dc8r2.benson-family.localad_kpwdport=464ad_krb_realm=BENSON-FAMILY.LOCALad_krb_kdc=tsr-dc8r2.benson-family.localad_krb_admin_server=tsr-dc8r2.benson-family.localad_krb_kpasswd_server=tsr-dc8r2.benson-family.localad_keytab_name=ad_keytab_principal=ad_keytab_file=ad_timeout=60ad_dns_timeout=60ad_ssl=offad_unix_extensions=0
#20

Stephen Benson wrote:
ad_bindname=tsradminad_domainname=benson-family.localad_netbiosname=BENSON-FAMILYad_basedn=DC=benson-family,DC=localad_binddn=tsradmin
BENSON-FAMILY.LOCALad_site=ad_dcname=tsr-dc8r2.benson-family.localad_dchost=tsr-dc8r2.benson-family.localad_dcport=389
Okay. Everything looks good. Have the right to you do this:
rm -f /etc/directoryservice/ActiveDirectory/configsh /etc/directoryservice/ActiveDirectory/ctl stopsh /etc/directoryservice/ActiveDirectory/ctl start
Post the results here
ad_gcname=tsr-dc8r2.benson-family.localad_gchost=tsr-dc8r2.benson-family.localad_gcport=3268ad_krbname=tsr-dc8r2.benson-family.local:88ad_krbhost=tsr-dc8r2.benson-family.localad_krbport=88ad_kpwdname=tsr-dc8r2.benson-family.local:464ad_kpwdhost=tsr-dc8r2.benson-family.localad_kpwdport=464ad_krb_realm=BENSON-FAMILY.LOCALad_krb_kdc=tsr-dc8r2.benson-family.localad_krb_admin_server=tsr-dc8r2.benson-family.localad_krb_kpasswd_server=tsr-dc8r2.benson-family.localad_keytab_name=ad_keytab_principal=ad_keytab_file=ad_timeout=60ad_dns_timeout=60ad_ssl=offad_unix_extensions=0
#21

Attached logs because that each command
#22

Stephen Benson wrote:
Attached logs because that each command
Even at 60 seconds, it"s timing out. More commands because that you to run ;-)
sqlite3 /data/freenas-v1.db "update directoryservice_activedirectory set ad_enable=1" company ix-kerberos startservice ix-nsswitch startservice ix-kinit startklist # friend should have actually a kerberos ticket giving ticket
/usr/local/bin/net -k ads join benson-family.local -S tsr-dc8r2.benson-family.local -p 389echo $? # this need to be 0
I"m curious what the network ads sign up with does. That appears to be whereby things space failing here.
#23

BENSON-FAMILY.LOCAL
Issued Expires PrincipalJan 7 22:36:40 january 8 08:36:40 krbtgt/BENSON-FAMILY.LOCAL
BENSON-FAMILY.LOCAL
#24
Stephen Benson wrote:
BENSON-FAMILY.LOCAL
Issued Expires PrincipalJan 7 22:36:40 jan 8 08:36:40 krbtgt/BENSON-FAMILY.LOCAL
BENSON-FAMILY.LOCAL
I goofed. Operation these regulates again:sqlite3 /data/freenas-v1.db "update directoryservice_activedirectory set ad_enable=1" business ix-kerberos startservice ix-nsswitch startservice ix-kinit startklist # friend should have a kerberos ticket granting ticket
service ix-pre-samba start
/usr/local/bin/net -k ads join benson-family.local -S tsr-dc8r2.benson-family.local -p 389echo $? # this should be 0
#25

Worked this time..
BENSON-FAMILY.LOCAL
Issued Expires PrincipalJan 7 22:36:40 january 8 08:36:40 krbtgt/BENSON-FAMILY.LOCAL
BENSON-FAMILY.LOCAL
#26
Stephen Benson wrote:
Worked this time..
BENSON-FAMILY.LOCAL
Issued Expires PrincipalJan 7 22:36:40 january 8 08:36:40 krbtgt/BENSON-FAMILY.LOCAL
BENSON-FAMILY.LOCAL
If it"s working from the command line, it need to be working from the UI. Have the right to you try from the UI now? prior to doing so, operation this native the command line:
sh /etc/directoryservice/ActiveDirectory/ctl stop
Let me understand if it functions from the UI
#27

Thanks John. Operated from UI as well. Wbinfo -u gets usernames fine together well. All go now.
Did you find anything certain that to be to reprimand or was it user error on mine side?
I to be on a check VM doing this an insect fixing and I"m looking at upgrading my house server, yet want come make certain it will work before I do. I tried 9.3 steady on that server critical week, as I had a drive issue, but had same problem joining.
Thanks again.
#28

Stephen Benson wrote:
Thanks John. Worked from UI together well. Wbinfo -u gets usernames fine as well. All walk now.
Did you uncover anything particular that to be to reference or was it user error on my side?
The just thing that I experienced was the sign up with timing out. As soon as you bumped up the timeout come 60 seconds, that makes everything work ;-)
I am on a test VM law this an insect fixing and also I"m looking in ~ upgrading my house server, yet want come make certain it will work prior to I do. I tried 9.3 secure on that server critical week, together I had actually a journey issue, yet had same problem joining.
What problems? to be it the same issue? have you tried to bump up the timeouts come 60 seconds on that too ?
Thanks again.
#29

Yes I had actually the same concern on my manufacturing machine, reverted back to 9.2.1.7 ~ above that. Ns will begin a fresh vm and try again come duplicate with timeouts in ~ 10 using an easy UI settings. If it stops working to start I will bump increase time outs and also see if that fixes it.
Thanks again because that the time.
#30

Stephen Benson wrote:
Yes I had actually the same problem on my production machine, reverted earlier to 9.2.1.7 on that. I will start a fresh vm and try again come duplicate v timeouts in ~ 10 using an easy UI settings. If it stops working to begin I will bump increase time outs and see if it fixes it.
Thanks again for the time.
See more: Palace Interior La Casa De Las Cortinas, Window Treatment Services In Florida
No problem. Since this was a timeout issue, I"m close up door this ticket out. If you have any new issues please open up a brand-new ticket ;-).
#31

#32

#33

#34

#35

#36

#37

#38

Also easily accessible in: Atom PDF