Description of problem: Not sure if this is adlci or realmd issue, but I have an impression that adcli does not fully support this option. So either it should be implemented/fixed in adcli or prevent realmd to use predeficed computer-ou and adcli for join. Version-Release number of selected component (if applicable): adcli-0.7.5-4.el7 realmd-0.16.1-3.el7 but the old realmd-0.14.6-6.el7 has this issue too How reproducible: always Steps to Reproduce: echo -n <password> | adcli join --verbose --domain <ad_domain> --domain-realm <AD_REALM> --domain-controller <ad_ip> --login-type user --login-user <login_user> --computer-ou OU=<OU> --stdin-password Actual results: Either ! Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0 adcli: joining domain ad.baseos.qe failed: Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data if the computer record does not exist in AD at all, or if it exists then the following error is displayed: adcli: joining domain <ad_domain> failed: The computer account <machine_hostname> already exists, but is not in the desired organizational unit.
NOTE, that in realmd-0.16.1-3.el7 adcli become the default membership software so this issue might be more visible. Changing the target release to RHEL-7.2, but leave the decision to fix/postpone to devel as the issue is not that critical and have a en easy workaround (--membership-software=samba).
The adcli command line is incorrect. The adcli documentation states: -O, --domain-ou=OU=xxx The full distinguished name of the OU in which to create the computer account. If not specified then the computer account will be created in a default location. In other words, an argument like OU=TestOU is an incomplete OU. If you are driving adcli directly, please specify the full OU, like this: OU=TestOU,DC=example,DC=com
So workaround for this is to specify a full DN to the realm client --computer-ou command. So I think this is a realmd bug. It should perform the qualification automatically before handing it off to adcli.
Fixed upstream here: http://cgit.freedesktop.org/realmd/realmd/commit/?id=3db35ad73ec57c8af499a0dcef96ffd4da914236
it would be nice to have it fixed, more than half a year later and admins still bog down there.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2511.html