I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening due to a stale account cleanup job that is in place on the domain controllers.

I found out if you do not set this value "ad_maximum_machine_account_password_age = " in your /etc/sssd.conf the default is to rotate the password every 30 days. I have systems where it is working and systems where it is not working. For testing purposes I set several systems to 1 day for the "ad_maximum_machine_account_password_age = 1" value.

I also raised logging to 10 to see if I can capture something in the log files as to success or failure of the rotation of the computer account password.

I was also able to rotate the password manually with this command

adcli update or adcli update --show-details --show-password --domain doaminXYZ

I am tempted to put a cron job that will run the command every 2 weeks but I do not like that solution. I would rather it just work properly.

Any ideas would be greatly appreciated.

I have opened a case with redhat but they are not being very helpful. I have also searched to the end of the internet for a solution and have come up empty so far.

Thanks in advance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.