Is there a command to get the list of AD Users (or) AD groups, that can access a Linux server, from the command prompt on the server itself without logging into the windows server? Below is how our sssd file looks like

 cat /etc/sssd/sssd.conf
access_provider = ad
ad_domain = xxxx.com
ad_gpo_access_control = enforcing
ad_gpo_cache_timeout = 3600
cache_credentials = True
default_shell = /usr/local/bin/shell
dyndns_update = False
fallback_homedir = /home/%u
id_provider = ad
krb5_realm = xxxx.COM
krb5_store_password_if_offline = True
ldap_id_mapping = False
ldap_schema = ad
ldap_sudo_search_base = OU=nonprod,OU=Blah,OU=blah,OU=blah,OU=Blah,DC=blah,DC=com?onelevel??OU=blah,OU=blah,OU=Linux,OU=bluhbluh,DC=blah,DC=com?onelevel??OU=blah,OU=blah,OU=blah,DC=blah,DC=com?onelevel??OU=Linux,OU=blah,DC=blah,DC=com?onelevel?
realmd_tags = manages-system joined-with-adcli
use_fully_qualified_names = False

config_file_version = 2
domains = xxxx.com
services = nss, pam, sudo

cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

There is a GPO on the OU to which this server is joined to, and it has the list of groups that can access the Linux server. I want to know if I can run a command from the server to get that list instead of getting into the Windows servers to get that information?

  • Have you tried ldapsearch? Though that doesn't go through sssd, you connect directly to the AD server. – dirkt Dec 27 '19 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.