Attaching CentOS to domain yields "DNS update failed: NT_STATUS_UNSUCCESSFUL"

Question

I'm getting the following error attaching a new CentOS 7 machine to a Windows domain.

[root@centos samba]# net ads join -U administrator
Enter administrator's password:
Using short domain name -- SUBDOMAIN
Joined 'centos' to dns domain 'SUBDOMAIN.FULLDOMAIN.com'
DNS update failed: NT_STATUS_UNSUCCESSFUL

In the link below it's suggested to "verify if dynamic DNS updates are working on your Samba domain controller". How do I do that on Windows Server 2008?

https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members#DNS_Update_failed:_ERROR_DNS_UPDATE_FAILED

Solution

If the member you are joining already has a record created in the Windows DNS server (because you did it when you first built the machine or whatever), and the DNS server is AD-integrated, you will usually see this message.

This is because Windows DNS by default requires secure dynamic updates when it is integrated to AD. This effectively applies some NTFS-style permissions to each DNS record. Normally when a machine is joined, it dynamically creates its DNS record with its own machine account as the owner and suitable permissions. These permissions allow updates from only that machine (and admins), so prevent other machines modifying the record via the dynamic update mechanism.

When you pre-create the record, you create a record where only the administrator/server has permission to change it and the machine-specific permission is missing (the machine account doesn't even exist at this point). When Samba completes the join, it goes to register the hostname in DNS and finds it can't as it has no permission.

Long story short, you can usually ignore the message if you have already created the A record.

Comments

[Mintra]

Does the CentOS server you are adding already have a record created for it in DNS (i.e. manually)?

[Christopher Hostage]

Thanks for the assist, but we went with another solution. It did have the DNS record, in any case.

[Mintra]

Thought so - that can cause this message. I'll post an answer for reference even though you already worked around.