Home
Professional News
Integrating Ubuntu with Windows Active Directory Domain

Integrating Ubuntu with Windows Active Directory Domain

Introduction

Integrating Ubuntu with Active Directory (AD) is a common requirement in mixed OS environments where Linux and Windows systems operate side by side. If you’re looking to join Ubuntu to a Windows domain, you’re in the right place. This step-by-step guide walks you through a secure integration using Samba, Kerberos, DNS, and supporting tools.

The goal is to enable Ubuntu systems to authenticate against Active Directory, just like native Windows clients. This streamlines centralized access control and ensures consistent user policy enforcement across your entire infrastructure.

1. Specify the name of the configured computer in the /etc/hostname file

Query the current host name:

cat /etc/hostname

If necessary, specify a new host name:

echo myhost > /etc/hostname

Note. Host name cannot be localhost, because localhost is the name for 127.0.0.1 (specified in the /etc/hosts file when you install the operating system).

2. Specify full domain controller name in the /etc/hosts file

Add a static record with full domain controller name in the end of the file /etc/hosts. Translation between IP address and the name of the computer is required so that you could use hostname instead of the IP address.

echo 192.168.1.51 hostname.db.local hostname >> /etc/hosts

3. Set a DNS server on the configured computer

Domain controller should be the first option for search. Add domain controller IP address to /etc/resolv.conf. In most of distributives resolv.conf is generated automatically, so add the domain controller IP address to the /etc/resolvconf/resolv.conf.d/head.

sudo vim /etc/resolvconf/resolv.conf.d/head

Change the opened file as follows:

domain domain.com
search domain.com
nameserver 
nameserver 8.8.8.8

Restart the networking service.

/etc/init.d/networking restart

Use nslookup command to check.

nslookup www.google.com

4. Configure time synchronization

The system time on the machine must be synchronized with the system time on domain controller server. Install the ntp tool and change the ntp.conf file.

sudo apt-get install ntp
sudo vim /etc/ntp.conf

Change the file as follows.

server dc.domain.com

Restart the ntpd daemon.

sudo /etc/init.d/ntp restart

5. Install a Kerberos client

sudo apt-get install krb5-user libpam-krb5 libpam-ccreds auth-client-config

6. Install Samba, Winbind and NTP

sudo apt-get install samba winbind ntp

7. Edit the /etc/krb5.conf file to add full domain name, domain controller name and the realm parameter

Important: Do not leave any comments tagged with the “#” sign in the config file.

[libdefaults]
    default_realm       =           DOMAIN.COM
    clockskew           =           300
    ticket_lifetime     =           1d
    forwardable         =           true
    proxiable           =           true
    dns_lookup_realm    =           true
    dns_lookup_kdc      =           true

[realms]
    DOMAIN.COM = {
    kdc            =       hostname.domain.com
    admin_server   =       hostname.domain.com
    default_domain =       DOMAIN.COM
    }

[domain_realm]
    .domain.com = DOMAIN.COM
    domain.com = DOMAIN.COM

[appdefaults]
    pam = {
    ticket_lifetime         = 1d
    renew_lifetime          = 1d
    forwardable             = true
    proxiable               = false
    retain_after_close      = false
    minimum_uid             = 0
    debug                   = false
    }

8. Edit the /etc/samba/smb.conf file to add short domain name and full domain name:

Important: Do not leave any comments tagged with the “#” sign in the config file.

[global]
   workgroup = DOMAIN
   realm = DOMAIN.COM
   security = ADS
   encrypt passwords = true
   socket options = TCP_NODELAY
   domain master = no
   local master = no
   preferred master = no
   os level = 0
   domain logons = 0
   server string = %h server (Samba, Ubuntu)
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes

Note. Before using the config file remove comment lines.

9. Enter the domain:

net ads join -U Administrator

After joining the domain successfully you will be able to ping Active Directory hostnames, e.g.:

ping johnny.domain.com

10. Verify that authentication for an Active Directory user is successful:

kinit [email protected]

Note: Type the domain name in upper-case letters.

If everything was configured correctly, the ticket will be created.

klist

And that’s it—you’ve now connected your Ubuntu system to Active Directory, enabling secure authentication between your Linux workstation and your Windows domain environment.

Looking to extend this integration to your databases? Check out our guide on Active Directory Authentication for MySQL.

Whether you’re managing a hybrid infrastructure or integrating Ubuntu for centralized access control, DataSunrise supports secure, standards-compliant authentication across both Linux and Windows environments.

If your organization handles sensitive data or faces compliance requirements under GDPR, SOX, or HIPAA, DataSunrise provides comprehensive protection with advanced audit logging, powerful security enforcement, and real-time data masking. Request a demo to see how we help organizations stay secure and compliant.