I have many RHEL servers configured with SSSD that are not rotating their AD computer account password and as a result their computer accounts are getting deleted from the AD domain. This is happening due to a stale account cleanup job that is in place on the domain controllers.
I found out if you do not set this value "ad_maximum_machine_account_password_age = " in your /etc/sssd.conf the default is to rotate the password every 30 days. I have systems where it is working and systems where it is not working. For testing purposes I set several systems to 1 day for the "ad_maximum_machine_account_password_age = 1" value.
I also raised logging to 10 to see if I can capture something in the log files as to success or failure of the rotation of the computer account password.
I was also able to rotate the password manually with this command
adcli update or adcli update --show-details --show-password --domain doaminXYZ
I am tempted to put a cron job that will run the command every 2 weeks but I do not like that solution. I would rather it just work properly.
Any ideas would be greatly appreciated.
I have opened a case with redhat but they are not being very helpful. I have also searched to the end of the internet for a solution and have come up empty so far.
Thanks in advance