BeyondTrust/pbis-open was archived in November 2021; do not install this on a new machine. The official approach on Ubuntu 24.04/26.04 is realmd + sssd + adcli. The ODT video remains below as a record of the old approach.Joining Ubuntu to Active Directory is how a Linux desktop or server authenticates with the same Windows account, without a local user on each machine. The domain is still on-premises AD DS (or Entra Domain Services, which emulates AD). Do not confuse it with Microsoft Entra ID (formerly Azure AD): cloud identity, without realm join.
What changed since PBIS
Likewise Open → PowerBroker Open → PBIS Open was the shortcut in 2007–2019: its own agent, stable UIDs, joining with one command. BeyondTrust archived the open-source code; the commercial product (AD Bridge) continues separately. On Ubuntu, the distro's stack took its place:
realmddiscovers the domain and orchestrates joining.adclicreates the computer account in AD and writes the keytab.sssd(providerad) handles NSS/PAM: login, groups, offline caching.
Winbind/Samba still works if the node is also a file server using CIFS. For “just authenticating AD users,” SSSD is Canonical's default. If AD is Samba 4 on Linux, the DC setup is in Samba4 Setup OpenSUSE — joining Ubuntu is the same.
Before joining: DNS, time, and name
Kerberos is unforgiving. If the clock falls behind by more than ~5 minutes or DNS cannot find _ldap._tcp, joining fails with an unhelpful message.
- Ubuntu's DNS points to the domain controller (it must be authoritative for the domain).
- Synchronized time —
chronyorsystemd-timesyncd, preferably against the DC itself. - Short hostname (an AD computer account has a NetBIOS limit of 15 characters) and FQDN in
/etc/hosts.
sudo hostnamectl set-hostname ubuntu-lab.ad1.example.com
# /etc/hosts: 10.51.0.11 ubuntu-lab.ad1.example.com ubuntu-lab
# DNS via netplan (ajuste o arquivo da interface)
# nameservers:
# addresses: [10.51.0.5]
sudo netplan apply
timedatectl status
resolvectl status
Packages and realm join
On Ubuntu 24.04 and 26.04 the official packages are enough. Do not download .deb files from third-party sites.
sudo apt update
sudo apt install sssd-ad sssd-tools realmd adcli
sudo realm -v discover ad1.example.com
sudo realm join -v ad1.example.com
# ou conta de join dedicada, não o Administrator do dia a dia:
# sudo realm join -v -U joiner ad1.example.com
realm discover must list server-software: active-directory and client-software: sssd. If discovery fails, the problem is DNS — not SSSD. Joining requests the password, invokes adcli, writes /etc/sssd/sssd.conf, enables PAM/NSS, and starts the service.
realm list
sudo adcli testjoin
getent passwd joao@ad1.example.com
id joao@ad1.example.com
The computer account appears in the Computers container in ADUC. A join OTP is available (--one-time-password) if company policy does not allow an admin password on the laptop.
sssd.conf: what matters
The realm has already generated the file. It needs to be 0600 root:root — otherwise SSSD refuses to start.
[sssd]
domains = ad1.example.com
config_file_version = 2
[domain/ad1.example.com]
id_provider = ad
access_provider = ad
ad_domain = ad1.example.com
krb5_realm = AD1.EXAMPLE.COM
cache_credentials = True
krb5_store_password_if_offline = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
ldap_id_mapping = True
default_shell = /bin/bash
cache_credentials— a laptop outside the network still authenticates (with a previously used password).use_fully_qualified_names = True— loginjoao@ad1.example.com. Only change it toFalseif you have a domain and are sure no trusted forest will be introduced.ldap_id_mapping— UID/GID derived from the SID. Stable across machines in the same domain; it is not the UID PBIS wrote to AD. If the old fleet depends on a fixed UID in the POSIX attribute, that is a different design (SFU /ldap_idmap_range/ idmap in Samba).
Automatic home directories ( realm does not enable this on its own):
sudo pam-auth-update --enable mkhomedir
Login, SSH, sudo, and who can sign in
On the desktop, GDM does not list AD users the first time: click “Not listed?” and enter joao@ad1.example.com. On subsequent logins, the user appears like a local one.
On servers, OpenSSH usually has password authentication disabled. Without a key, AD login will not work until you deliberately enable it:
# /etc/ssh/sshd_config.d/ad.conf (só se a política permitir senha)
PasswordAuthentication yes
KbdInteractiveAuthentication yes
sudo systemctl reload ssh
Restrict who can log in — do not let the entire domain SSH into the jump host:
sudo realm deny --all
sudo realm permit -g 'linux-admins@ad1.example.com'
Sudo for an AD group (the space in the name is escaped with a backslash):
%linux-admins@ad1.example.com ALL=(ALL:ALL) ALL
SSH with an FQDN has two @: ssh joao@ad1.example.com@ubuntu-lab. Kerberos ticket after login: apt install krb5-user and klist. Actual GPO support on Ubuntu is another package — Canonical's ADSys , not SSSD alone.
On-prem AD, Entra, and Samba
- AD DS (Windows Server 2022/2025) — this how-to.
- Entra Domain Services — managed AD on Azure; joining uses the same stack, with the realm in UPPERCASE.
- Entra ID — SSO/OIDC/SAML. Does not create a Kerberos computer account. The wrong tool for “putting Ubuntu on the domain.”.
- Samba 4 as a DC — Ubuntu joins the same way; the DC is a separate post.
There is a companion to this article, focused on the desktop: Ubuntu in Windows Active Directory. To repeat the join on dozens of nodes, the playbook belongs in Ansible rather than a 2017 gist.
Leave the domain:
sudo realm leave ad1.example.com
The 2017 video (PBIS on 16.04)
The walkthrough recorded for Canal ODT uses Ubuntu 16.04 and the BeyondTrust agent. It provides historical context; the script's commands are not what you run today.
Current docs: Ubuntu Server — SSSD with Active Directory. SSSD code: github.com/SSSD/sssd.