Join RHEL 10 to Active Directory with Samba Winbind

Samba Winbind connects Linux to Active Directory for identity and authentication through Kerberos and SMB/RPC. On RHEL 10, the supported path is realm join with --membership-software=samba and --client-software=winbind, which configures Samba, NSS, PAM, and Winbind together.

Use SSSD and realmd for typical interactive Linux logins. Choose Winbind when this host runs Samba and needs DOMAIN\user semantics for file shares or related services.

Quick answer

Install packages, point DNS at the domain controller, then join with realmd’s Winbind profile:

sudo realm join --membership-software=samba --client-software=winbind lab.example -U Administrator

Verify trust and user lookup:

sudo net ads testjoin
wbinfo -t
getent passwd 'LAB\jane'

Winbind exposes LAB\username names. SSSD exposes user@domain.example and is the better default for SSH and sudo on a generic server.

SSSD vs Winbind for Active Directory

Do not run SSSD and Winbind as parallel identity providers on the same host without a deliberate design. Pick one stack per system.

How Samba Winbind connects Linux to Active Directory

              Linux host (Samba member)
                         ↓
                    Winbind daemon
                         ↓
              Kerberos + LDAP / RPC to AD
                         ↓
         Windows Server 2025 domain controller

Winbind caches SID-to-UID mappings, lists domain users and groups for NSS, and keeps the machine account password in sync with Active Directory.

Test environment

Prerequisites before joining the AD domain

Point the client resolver at the DC, confirm the hostname FQDN, and keep time synchronized with the domain.

Confirm LDAP SRV records:

dig +short _ldap._tcp.lab.example SRV

0 100 389 win-8s0k67ep5eo.lab.example.

When SRV records resolve, confirm the system clock is synchronized before you join:

timedatectl | grep 'System clock synchronized'

System clock synchronized: yes

The Samba computer account name comes from the short hostname of the FQDN:

hostname -f

vm1.lab.example

Install Samba and Winbind

Install the Samba member-server stack, realmd, and Kerberos client tools:

sudo dnf install -y \
  realmd \
  oddjob \
  oddjob-mkhomedir \
  samba \
  samba-winbind \
  samba-winbind-clients \
  samba-winbind-krb5-locator \
  samba-client \
  samba-common-tools \
  krb5-workstation

Verify the Winbind components:

rpm -q realmd samba-winbind samba-winbind-clients

realmd-0.17.1-13.el10_1.x86_64
samba-winbind-4.23.5-111.el10_2.x86_64
samba-winbind-clients-4.23.5-111.el10_2.x86_64

Join using realmd and Winbind

Red Hat documents joining Active Directory with Samba Winbind through realm join and explicit client/membership software flags.

Record the current auth profile before you change it:

authselect current

Join the domain (you will be prompted for the join account password):

sudo realm join --membership-software=samba --client-software=winbind lab.example -U Administrator

realm join calls the enrollment tools, writes Samba and Kerberos settings, selects the winbind authselect profile (with oddjobd for homedirs), and starts Winbind. Verbose joins may show authselect select winbind with-mkhomedir --force when replacing an existing profile.

After a successful join, expect:

• /etc/samba/smb.conf with security = ADS, realm, workgroup, and idmap sections
• winbind entries in /etc/nsswitch.conf through authselect
• PAM stacks that use Winbind
• /etc/krb5.keytab for the machine account
• winbind and oddjobd enabled

Inspect the generated Samba settings:

sudo testparm -s

Server role: ROLE_DOMAIN_MEMBER
...
	security = ADS
	workgroup = LAB
	realm = LAB.EXAMPLE
	idmap config lab : backend = rid
...

Exact idmap ranges are written by realmd; use testparm -s on your host rather than copying static numbers from another system.

Configure the Winbind Kerberos local-auth plugin

RHEL uses the Winbind Kerberos local-auth plugin to map Kerberos principals to the corresponding Winbind identity. Add this section to /etc/krb5.conf (merge with any existing [plugins] block if your file already has one):

[plugins]
    localauth = {
        module = winbind:/usr/lib64/samba/krb5/winbind_krb5_localauth.so
        enable_only = winbind
    }

Membership should show Winbind as the client stack:

realm list

lab.example
  type: kerberos
  realm-name: LAB.EXAMPLE
  domain-name: lab.example
  configured: kerberos-member
  server-software: active-directory
  client-software: winbind
  login-formats: LAB\%U

Confirm the machine trust:

sudo net ads testjoin

Join is OK

Winbind should also report a healthy trust secret to the domain:

wbinfo -t

checking the trust secret for domain LAB via RPC calls succeeded

On the domain controller, confirm VM1 under Computers in Active Directory Users and Computers if you want a GUI check.

Verify Active Directory users and groups

Start Winbind before Samba when you will query domain users for shares or services. Use wbinfo for Winbind diagnostics and getent for what NSS-backed applications see.

sudo systemctl enable --now winbind oddjobd

Confirm the Winbind daemon answers RPC pings:

wbinfo -p

Ping to winbindd succeeded

List domain users and groups:

wbinfo -u | head -5

LAB\administrator
LAB\guest
LAB\krbtgt
LAB\jane
LAB\john

NSS applications use getent, which returns the DOMAIN\user form when winbind use default domain is not enabled:

getent passwd 'LAB\jane'

LAB\jane:*:11105:1000513::/home/jane@LAB:/bin/bash

id should show the same account with group memberships:

id 'LAB\jane'

uid=11105(LAB\jane) gid=1000513(LAB\domain users) groups=1000513(LAB\domain users),11103(LAB\network-admins)

Jane’s UID 11105 follows the configured RID range plus her account RID (1105). The domain group Domain Users is a well-known group in your AD domain with RID 513, which often maps to values like 1000513 on a member server. Confirm mappings on your host with wbinfo -Y on the group SID rather than assuming every ID is range + RID.

Enable Samba after Winbind is healthy:

sudo systemctl enable --now smb

Manual alternative: join with net ads join

Use this path when you manage smb.conf yourself or you are following documentation that predates the realmd Winbind flags.

Verify the client can obtain an AD Kerberos ticket (the principal includes the realm explicitly):

kinit Administrator@LAB.EXAMPLE

A ticket in the cache confirms the KDC accepted the password:

klist

Destroy the ticket when you are done testing:

kdestroy

Example member-server [global] baseline before join:

[global]
   workgroup = LAB
   realm = LAB.EXAMPLE
   security = ADS
   dedicated keytab file = /etc/krb5.keytab
   kerberos method = secrets and keytab
   winbind refresh tickets = yes
   winbind use default domain = no
   template shell = /bin/bash
   template homedir = /home/%U@%D
   idmap config * : backend = tdb
   idmap config * : range = 3000-7999
   idmap config LAB : backend = rid
   idmap config LAB : range = 10000-20000

Validate syntax:

sudo testparm -s

Select Winbind in authselect, then join:

sudo authselect select winbind with-mkhomedir

Join with a domain administrator or delegated account:

sudo net ads join -U Administrator

DNS update warnings are common in labs without secure DNS delegation; look for Joined 'VM1' to dns domain and then run net ads testjoin.

If you used this manual path instead of realm join, add the Winbind Kerberos localauth plugin block to /etc/krb5.conf as shown in the realmd Winbind join section above.

Quick Samba share smoke test

After join, prove that Winbind identities can reach smbd with a minimal share. For SELinux, ACLs, write list, firewall, and Windows access patterns, use Configure Samba shares for Active Directory users.

Create /srv/projects, set group LAB\network-admins and mode 2770, add a [projects] stanza with valid users = @"LAB\network-admins", then run sudo testparm -s and sudo systemctl reload smb. Confirm with smbclient //127.0.0.1/projects -U 'LAB\jane' and a quick mkdir at the smb: prompt.

Winbind ID mapping explained

Active Directory identifies users with SIDs (S-1-5-21-…). Linux processes expect numeric UIDs and GIDs. Winbind maps between them through an idmap backend.

After realm join, inspect the active ranges with testparm -s and validate a user with id 'LAB\username'.

Leave the Active Directory domain

With realmd managing the join:

sudo realm leave lab.example

To remove the computer object from AD as well:

sudo realm leave --remove lab.example -U Administrator

On a manual net ads join host, use sudo net ads leave -U Administrator and restore the authselect profile you recorded before join.

Troubleshooting Samba/Winbind Active Directory integration

Summary

On RHEL 10, join Active Directory as a Samba member with realm join --membership-software=samba --client-software=winbind. That is the current integrated path: realmd writes smb.conf, enables Winbind in NSS/PAM, and enrolls the computer account. Verify with realm list, net ads testjoin, wbinfo -t, and getent passwd 'LAB\user'.

Use the manual net ads join section when you own smb.conf end to end. For file shares, set Unix group ownership on the path and test with smbclient as a domain user in the authorized group—not with anonymous smbclient -N listing.

For ordinary Linux login and realm permit policy, SSSD with realmd remains the simpler choice. Manual SSSD after adcli join is covered in the adcli guide.

References

• Red Hat Enterprise Linux 10 — Setting up Samba as an Active Directory domain member
• Red Hat Enterprise Linux 10 — Joining a domain with Samba Winbind
• Samba Wiki — Winbind