I am on CentOS 6.7 and want to add two domain admins to the sudo group.

I have tried adding both users individully and both together see below:

someuser ALL=(ALL) ALL #THIS Works, but is not a domain account 

%domain\ admins ALL=(ALL) ALL #this does not work

CS\domainUser ALL=(ALL) ALL #this does not work either

cs\domainUser ALL=(ALL) ALL #this does not work either

anotherdomainUser ALL=(ALL) ALL #this does not work either

When I su into each doamin user then run the sudo command I type my password as prompted and I get a wrong password error.

What am I doing wrong?

2 Answers 2


When you're doing groups, you need to have two backslashes. This tells Linux/sudo that you're escaping a backslash, otherwise, it treats it as something else.

%domain\\group ALL=(ALL) ALL

  • Just tied it. Still doesn't work. (As in it will not let my AD user run sudo... Says incorrect password.)
    – now_world
    Commented Jan 27, 2016 at 15:22
  • How did you add your machine to AD exactly? Are you using sssd or samba?
    – Sokel
    Commented Jan 27, 2016 at 15:58
  • We used samba...
    – now_world
    Commented Jan 27, 2016 at 16:02
  • You may need to switch the order of your /etc/nsswitch.conf for "groups" to make files the last on the list from winbind, like: groups: winbind files. This is a sort of "bug" because of how sudo looks for groups. This should work. However, it is better practice to no longer use winbind and to rely on adcli and sssd (or realm if you are using CentOS 7). Please read the following links for an idea to add to a domain via adcli and setting up sssd. CentOS 6: goo.gl/XInEfJ CentOS 7: goo.gl/pNHWoD -- You may have better luck that way.
    – Sokel
    Commented Jan 27, 2016 at 16:52

Names containing spaces should either be double-quoted, or each space specified as \x20.

%sudo              ALL = (ALL) ALL
%"domain users"    ALL = (ALL) ALL
+"domain users"    ALL = (ALL) ALL
%domain\x20admins  ALL = (ALL) NOPASSWD: ALL

NB. On older systems you may need to use + instead of % as the AD groups used to be provided much like NIS/YP netgroups. These days this should not be necessary.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .