Endpoint-ийг Active Directory-д нэгтгэх — 4-р хэсэг: Error: Warning: user would have been denied GPO-based logon access…

Bitdefender-ийн албан ёсны баримтаас орчуулавАнгли эх (EN) · Орчуулсан: 2026.11.12

Энэ хуудсыг AI-аар орчуулж, автоматаар шалгасан. Нарийн тохиргоо хийхээсээ өмнө англи эхтэй тулгаж болно.

Error: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.

krb5.conf файлын тохиргоо дутуу байгаас энэ алдаа гарна.

● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-09-26 12:15:44 EDT; 2 weeks 0 days ago
 Main PID: 25700 (sssd)
    Tasks: 4
   CGroup: /system.slice/sssd.service
           ├─25700 /usr/sbin/sssd -i --logger=files
           ├─25701 /usr/libexec/sssd/sssd_be --domain yyz.local --uid 0 --gid 0 --logger=files
           ├─25702 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
           └─25703 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

Oct 11 10:32:59 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Group Policy Container with DN [cn={8F655C32-3704-42C7-9BAD-5CC2C1A3AE55},cn=policies,cn=system,DC=yyz,DC=local] is unreadable or has unreadable or missing attributes. In order to fix this make sure that this AD object has following attributes readable: nTSecurityDescriptor, cn, gPCFileSysPath, gPCMachineExtensionNames, gPCFunctionalityVersion, flags. Alternatively if you do not have access to the server or can not change permissions on this object, you can use option ad_gpo_ignore_unreadable = True which will skip this GPO.See 'man ad_gpo_ignore_unreadable for details.'
Oct 11 10:32:59 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.
Oct 11 10:36:35 10-10-192-49.yyz.local sssd_be[25701]: GSSAPI client step 1
Oct 11 10:36:35 10-10-192-49.yyz.local sssd_be[25701]: GSSAPI client step 1
Oct 11 10:36:35 10-10-192-49.yyz.local sssd_be[25701]: GSSAPI client step 1
Oct 11 10:36:35 10-10-192-49.yyz.local sssd_be[25701]: GSSAPI client step 2
Oct 11 10:40:31 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Group Policy Container with DN [cn={8F655C32-3704-42C7-9BAD-5CC2C1A3AE55},cn=policies,cn=system,DC=yyz,DC=local] is unreadable or has unreadable or missing attributes. In order to fix this make sure that this AD object has following attributes readable: nTSecurityDescriptor, cn, gPCFileSysPath, gPCMachineExtensionNames, gPCFunctionalityVersion, flags. Alternatively if you do not have access to the server or can not change permissions on this object, you can use option ad_gpo_ignore_unreadable = True which will skip this GPO.See 'man ad_gpo_ignore_unreadable for details.'
Oct 11 10:40:31 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.
Oct 11 10:40:54 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Group Policy Container with DN [cn={8F655C32-3704-42C7-9BAD-5CC2C1A3AE55},cn=policies,cn=system,DC=yyz,DC=local] is unreadable or has unreadable or missing attributes. In order to fix this make sure that this AD object has following attributes readable: nTSecurityDescriptor, cn, gPCFileSysPath, gPCMachineExtensionNames, gPCFunctionalityVersion, flags. Alternatively if you do not have access to the server or can not change permissions on this object, you can use option ad_gpo_ignore_unreadable = True which will skip this GPO.See 'man ad_gpo_ignore_unreadable for details.'
Oct 11 10:40:54 10-10-192-49.yyz.local sssd[be[yyz.local]][25701]: Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode.

Шийдэл

krb5.conf файлын [realms] хэсэг дараах байдлаар тохируулагдсан эсэхийг шалгана:

[libdefaults]
       default_realm = EXAMPLE.LOCAL
       dns_lookup_realm = true
       dns_lookup_kdc = true
       dns_fallback = yes
[realms]
       EXAMPLE.LOCAL = {
             kdc = example.local
             default_domain = example.local
       }
[domain_realm]
       .EXAMPLE.LOCAL = EXAMPLE.LOCAL
       EXAMPLE.LOCAL = EXAMPLE.LOCAL

Error: kadmin: Missing parameters in krb5.conf required for kadmin client while initializing kadmin interface

krb5.conf файлын тохиргоо дутуу байгаас энэ алдаа гарна.

# kadmin list_principals
kadmin: Missing parameters in krb5.conf required for kadmin client while initializing kadmin interface

Шийдэл

krb5.conf файлын [realms] хэсэг дараах байдлаар тохируулагдсан эсэхийг шалгана:

[libdefaults]
       default_realm = EXAMPLE.LOCAL
       dns_lookup_realm = true
       dns_lookup_kdc = true
       dns_fallback = yes
[realms]
       EXAMPLE.LOCAL = {
             kdc = example.local
             default_domain = example.local
       }
[domain_realm]
       .EXAMPLE.LOCAL = EXAMPLE.LOCAL
       EXAMPLE.LOCAL = EXAMPLE.LOCAL

Hostname өөр төхөөрөмж дээр ашиглагдаж байгаа эсэхийг шалгана.
Төхөөрөмж Active Directory дээр идэвхгүй (disabled) болгогдсон эсэхийг шалгана.

Error: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database)

krb5.conf файлд rdns параметр байхгүйгээс энэ алдаа гарна.

------------------------ldapsearch -Y GSSAPI cn=Administrator---------------------------------
● sssd.service - System Security Services Daemon
   Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-10-11 16:43:20 EDT; 1min 30s ago
 Main PID: 1923 (sssd)
    Tasks: 4
   CGroup: /system.slice/sssd.service
           ├─1923 /usr/sbin/sssd -i --logger=files
           ├─1963 /usr/libexec/sssd/sssd_be --domain yyz.local --uid 0 --gid 0 --logger=files
           ├─1967 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files
           └─1968 /usr/libexec/sssd/sssd_pam --uid 0 --gid 0 --logger=files

Oct 11 16:43:32 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:32 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:32 10-10-192-49.yyz.local sssd[be[yyz.local]][1963]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)
Oct 11 16:43:32 10-10-192-49.yyz.local sssd[nss][1967]: Enumeration requested but not enabled
Oct 11 16:43:36 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:36 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:36 10-10-192-49.yyz.local sssd[be[yyz.local]][1963]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)
Oct 11 16:43:36 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:36 10-10-192-49.yyz.local sssd_be[1963]: GSSAPI client step 1
Oct 11 16:43:36 10-10-192-49.yyz.local sssd[be[yyz.local]][1963]: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Server not found in Kerberos database)

Шийдэл

krb5.conf файлд rnds=false нэмнэ:

[libdefaults]
       default_realm = EXAMPLE.LOCAL
       dns_lookup_realm = true
       dns_lookup_kdc = true
       dns_fallback = yes
       rdns = false
[realms]
       EXAMPLE.LOCAL = {
             kdc = example.local
             default_domain = example.local
       }
[domain_realm]
       .EXAMPLE.LOCAL = EXAMPLE.LOCAL
       EXAMPLE.LOCAL = EXAMPLE.LOCAL

Winbind-ээр domain-д нэгтгэх үеийн алдаа засах (Troubleshooting)

Энэ хэсэгт Winbind-ээр Active Directory domain-д нэгтгэх явцад гарч болох алдааны жагсаалт байна.

Жишээ:

Realm: example.local
Domain User: administrator
Domain IP: 11.11.11.11

Error: failed to generate credentials cache file for keytab file: default

Төхөөрөмжийн hostname дээд тал нь 15 тэмдэгт байж болно.

# net ads join -U administrator
Our netbios name can be at most 15 chars long, "MAC-00-50-56-A9-06-E1" is 21 chars long
Invalid configuration.  Exiting....
Failed to join domain: The format of the specified computer name is invalid.

Шийдэл

Hostname-ийг солино.

Error: No DNS domain configured for suse15-user. Unable to perform DNS Update.

Active Directory-д нэгдэх үед заримдаа net команд DNS-ийг шинэчилж чаддаггүй.

# net ads join -U administrator
Enter administrator's password:
Using short domain name -- EXAMPLE
Joined 'SUSE15-USER' to dns domain 'example.local'
No DNS domain configured for suse15-user. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER

Шийдэл

Машины IP болон FQDN-ийг etc/hosts файлд нэмнэ.
```
12.12.12.12     suse15-name.example.local     suse15-name
```
Командыг дахин ажиллуулна.
Эсвэл командыг --no-dns-update параметртэй ажиллуулж болно.

Error: The format of the specified computer name is invalid.

# net ads join -U administrator
Our netbios name can be at most 15 chars long, "MAC-XX-XX-XX-XX-XX-XX" is 21 chars long
Invalid configuration.  Exiting....
Failed to join domain: The format of the specified computer name is invalid.

Шийдэл

Дараах командыг ажиллуулж hostname-ийг солино.
```
 # systemctl set-hostname <NAME>
```
/etc/hostname файлаас хуучин нэрийг устгаад шинээр нь бичнэ.
/etc/hosts файл дахь төхөөрөмжийн нэрийн бүх хуучин нэрийг шинээр нь солино.
Төхөөрөмжийг дахин асаана.

Error: No DNS domain configured. Unable to perform DNS Update

Active Directory-д нэгдэх үед заримдаа net команд DNS-ийг шинэчилж чаддаггүй.

# net ads join -U administrator
Enter administrator's password:
Using short domain name -- SAMDOM
Joined 'AD-Member' to dns domain 'samdom.example.com'
No DNS domain configured for AD-Member. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER

Шийдэл

Машины IP болон FQDN-ийг /etc/hosts файлд нэмнэ.
```
 12.12.12.12    AD-Member.samdom.example.com     AD-Member
```
Командыг дахин ажиллуулна.
Эсвэл командыг --no-dns-update параметртэй ажиллуулж болно.

Error: E: Package 'krb5-config' has no installation candidate

krb5-config багцыг суулгаж чадахгүй байна.

# sudo apt install samba krb5-config krb5-user winbind libpam-winbind libnss-winbind
Reading package lists... Done
Building dependency tree
Reading state information... Done
Package krb5-config is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
E: Package 'krb5-config' has no installation candidate

# sudo apt install samba krb5-user winbind libpam-winbind libnss-winbind
Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 krb5-user : Depends: krb5-config but it is not installable
 samba : Depends: python-dnspython but it is not installable
         Depends: python-samba but it is not going to be installed
         Depends: samba-common-bin (= 2:4.5.16+dfsg-1+deb9u4) but it is not going to be installed
         Depends: tdb-tools but it is not installable
         Recommends: attr but it is not installable
         Recommends: samba-dsdb-modules but it is not going to be installed
         Recommends: samba-vfs-modules but it is not going to be installed
 winbind : Depends: samba-common-bin (= 2:4.5.16+dfsg-1+deb9u4) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Шийдэл

/etc/apt/sources.list файл дахь #deb-ээр эхэлсэн мөрүүдийн тайлбарыг (comment) авна.

Repo-г шинэчлээд командыг дахин ажиллуулна.

# apt update
# sudo apt install samba krb5-config krb5-user winbind libpam-winbind libnss-winbind

Error: ads_keytab_open: Invalid kerberos method set (0)

smb.conf файлд нэг хэсэг дутуу байгаас энэ асуудал гарна.

# sudo net ads keytab create -U administrator

Warning: "kerberos method" must be set to a keytab method to use keytab functions.
Enter administrator's password:
ads_keytab_open: Invalid kerberos method set (0)

Шийдэл

/etc/samba/smb.conf файлд дараах мөрийг нэмнэ:
```
kerberos method = secrets and keytab
```
Командыг дахин ажиллуулна.

Error: could not obtain winbind interface details: WBC_ERR_WINBIND_NOT_AVAILABLE

Шалгах командууд амжилтгүй болно.

# wbinfo -t
could not obtain winbind interface details: WBC_ERR_WINBIND_NOT_AVAILABLE
could not obtain winbind domain name!
checking the trust secret for domain (null) via RPC calls failed
failed to call wbcCheckTrustCredentials: WBC_ERR_WINBIND_NOT_AVAILABLE
Could not check secret
[root@fedgia samba]#  wbinfo -u
could not obtain winbind interface details: WBC_ERR_WINBIND_NOT_AVAILABLE
could not obtain winbind domain name!
Error looking up domain users
[root@fedgia samba]#  wbinfo -g
could not obtain winbind interface details: WBC_ERR_WINBIND_NOT_AVAILABLE
could not obtain winbind domain name!
failed to call wbcListGroups: WBC_ERR_WINBIND_NOT_AVAILABLE
Error looking up domain groups

Шийдэл

Дараах командыг ажиллуулна.
```
# systemctl enable winbind --now
```
Командуудыг дахин ажиллуулна.

Error: Failed to join domain: failed to lookup DC info for domain 'EXAMPLE.LOCAL' over rpc: NT_STATUS_CONNECTION_RESET

Нэгтгэх команд NT_STATUS_CONNECTION_RESET алдаатай амжилтгүй болно.

# net ads join -U Administrator
Enter Administrator's password:
Failed to join domain: failed to lookup DC info for domain 'EXAMPLE.LOCAL' over rpc: NT_STATUS_CONNECTION_RESET

Шийдэл

Active Directory дээр SMBv1-ийг суулгана. Server Manager → Dashboard → Start the Remove Roles and Features → Features → SMB 1.0/CIFS Files Sharing Support хэсэгт очно.
Командыг дахин ажиллуулна.

Error: DNS update failed!

Энэ нь асуудал биш. Төхөөрөмж Active Directory-д амжилттай нэгдсэн.

# net ads join -U Administrator
Enter Administrator's password:
Using short domain name -- EXAMPLE
Joined '|USER-USER3' to dns domain 'example.local'
No DNS domain configured for user-user3. Unable to perform DNS Update.
DNS update failed!

Error: The net Command Fails to Connect to the 127.0.0.1 IP Address

Үндсэн тохиргоогоор net команд 127.0.0.1 IP хаягтай холбогддог. Samba loopback интерфейс дээр сонсохгүй бол холболт амжилтгүй болно. Жишээ нь:

# net rpc rights list -U administrator
Enter administrator's password:
Could not connect to server 127.0.0.1
Connection failed: NT_STATUS_CONNECTION_REFUSED

Шийдэл

/etc/samba/smb.conf файлын [global] хэсэгт дараах параметрүүдийг нэмнэ:
```
bind interfaces only = yes
interfaces = lo eth0
```
Samba үйлчилгээ(нүүд)ийг дахин асаана.
net командад -I IP_address эсвэл -S host_name параметрийг дамжуулна.

Error: getent not Finding Domain Users and Groups

Заримдаа getent passwd эсвэл getent group юу ч харуулдаггүй.

# getent passwd
# getent group

Шийдэл

/etc/samba/smb.conf файлын [global] хэсэгт дараах параметрүүдийг нэмнэ:

winbind enum users = yes
winbind enum groups = yes

Тэмдэглэл

Эдгээр мөр системийг удаашруулдаг тул зөвхөн туршилтын зорилгоор нэмнэ.

Error: DNS Update failed: ERROR_DNS_GSS_ERROR

Active Directory-д нэгдэх үед Active Directory дээрх Kerberos буруу тохируулагдсанаас заримдаа net команд ERROR_DNS_GSS_ERROR алдаатай амжилтгүй болдог.

# net ads join -U administrator
Enter administrator's password:
Using short domain name -- SAMDOM
Joined 'AD-Member' to dns domain 'samdom.example.com'
DNS Update for AD-Member.samdom.example.com failed: ERROR_DNS_GSS_ERROR
DNS update failed: NT_STATUS_UNSUCCESSFUL

Шийдэл

Автомат дахин тохиргоог ажиллуулна:

# samba_upgradedns --dns-backend=BIND9_DLZ
Reading domain information
DNS accounts already exist
No zone file /usr/local/samba/private/dns/SAMDOM.EXAMPLE.COM.zone
DNS records will be automatically created
DNS partitions already exist
dns-DC1 account already exists
See /usr/local/samba/private/named.conf for an example configuration include file for BIND
and /usr/local/samba/private/named.txt for further documentation required for secure DNS updates
Finished upgrading DNS

BIND үйлчилгээг дахин асаана.

Error: Failed to join domain: Invalid configuration ("workgroup" set to 'EXAMPLE.LOCAL', should be 'EXAMPLE') and configuration modification was not requested

authconfig командыг буруу ажиллуулснаас нэгтгэх команд амжилтгүй болно.

# net ads join -U Administrator
Enter Administrator's password:
Failed to join domain: Invalid configuration ("workgroup" set to 'EXAMPLE.LOCAL', should be 'EXAMPLE') and configuration modification was not requested

Шийдэл

Дараах командыг зөв ажиллуулна.

# authconfig \
 --enablekrb5 \
 --krb5kdc=example.local \
 --krb5adminserver=example.local \
 --krb5realm=EXAMPLE.LOCAL \
 --enablewinbind \
 --enablewinbindauth \
 --smbsecurity=ads \
 --smbrealm=EXAMPLE.LOCAL \
 --smbservers=example.local \
 --smbworkgroup=example\
 --winbindtemplatehomedir=/home/%U \
 --winbindtemplateshell=/bin/bash \
 --enablemkhomedir \
 --enablewinbindusedefaultdomain \
 --update

Error: winbind.service: main process exited, code=exited, status=1/FAILURE

Winbind үйлчилгээг эхлүүлж чадсангүй.

# service winbind status
Redirecting to /bin/systemctl status winbind.service
● winbind.service - Samba Winbind Daemon
   Loaded: loaded (/usr/lib/systemd/system/winbind.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2022-09-26 10:15:35 EDT; 56s ago
     Docs: man:winbindd(8)
           man:samba(7)
           man:smb.conf(5)
  Process: 12649 ExecStart=/usr/sbin/winbindd --foreground --no-process-group $WINBINDOPTIONS (code=exited, status=1/FAILURE)
 Main PID: 12649 (code=exited, status=1/FAILURE)
   Status: "Starting process..."

Sep 26 10:15:35 rhel7x64tl winbindd[12649]: [2022/09/26 10:15:35.316642,  0] ../../source3/winbindd/winbindd_cache.c:3166(initialize_winbindd_cache)
Sep 26 10:15:35 rhel7x64tl winbindd[12649]:   initialize_winbindd_cache: clearing cache and re-creating with version number 2
Sep 26 10:15:35 rhel7x64tl winbindd[12649]: [2022/09/26 10:15:35.319950,  0] ../../source3/winbindd/winbindd_util.c:1279(init_domain_list)
Sep 26 10:15:35 rhel7x64tl winbindd[12649]:   Could not fetch our SID - did we join?
Sep 26 10:15:35 rhel7x64tl winbindd[12649]: [2022/09/26 10:15:35.319999,  0] ../../source3/winbindd/winbindd.c:1462(winbindd_register_handlers)
Sep 26 10:15:35 rhel7x64tl winbindd[12649]:   unable to initialize domain list
Sep 26 10:15:35 rhel7x64tl systemd[1]: winbind.service: main process exited, code=exited, status=1/FAILURE
Sep 26 10:15:35 rhel7x64tl systemd[1]: Failed to start Samba Winbind Daemon.
Sep 26 10:15:35 rhel7x64tl systemd[1]: Unit winbind.service entered failed state.
Sep 26 10:15:35 rhel7x64tl systemd[1]: winbind.service failed.

Шийдэл

CentOS6, RHEL7 дээр Winbind ашиглан Active Directory-д нэгтгэх хэсгийн алхмуудыг ашиглан төхөөрөмжийг Active Directory-д нэгтгэнэ.

Энэ хуудсанд гарсан нэр томъёо

Endpoint: Хамгаалж буй компьютер, сервер, виртуал машин
Policy: Хамгаалалтын тохиргооны багц; төхөөрөмж эсвэл бүлэгт оноодог

Асуулт байна уу?AI туслах GravityZone-ийн монгол баримтаас хайна. Нарийн асуудлыг таны гэрээт борлуулагч, Bitdefender Mongolia-ийн инженер шийднэ.