'\" t .\" Title: adcli .\" Author: Stef Walter .\" Generator: DocBook XSL Stylesheets v1.79.1 .\" Date: 08/15/2016 .\" Manual: System Commands .\" Source: realmd .\" Language: English .\" .TH "ADCLI" "8" "" "realmd" "System Commands" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\" http://bugs.debian.org/507673 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" ----------------------------------------------------------------- .\" * set default formatting .\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .\" ----------------------------------------------------------------- .\" * MAIN CONTENT STARTS HERE * .\" ----------------------------------------------------------------- .SH "NAME" adcli \- Tool for performing actions on an Active Directory domain .SH "SYNOPSIS" .HP \w'\fBadcli\ info\fR\ 'u \fBadcli info\fR domain\&.example\&.com .HP \w'\fBadcli\ join\fR\ 'u \fBadcli join\fR domain\&.example\&.com .HP \w'\fBadcli\ update\fR\ 'u \fBadcli update\fR .HP \w'\fBadcli\ create\-user\fR\ 'u \fBadcli create\-user\fR [\-\-domain=domain\&.example\&.com] user .HP \w'\fBadcli\ delete\-user\fR\ 'u \fBadcli delete\-user\fR [\-\-domain=domain\&.example\&.com] user .HP \w'\fBadcli\ create\-group\fR\ 'u \fBadcli create\-group\fR [\-\-domain=domain\&.example\&.com] user .HP \w'\fBadcli\ delete\-group\fR\ 'u \fBadcli delete\-group\fR [\-\-domain=domain\&.example\&.com] user .HP \w'\fBadcli\ add\-member\fR\ 'u \fBadcli add\-member\fR [\-\-domain=domain\&.example\&.com] group user... .HP \w'\fBadcli\ remove\-member\fR\ 'u \fBadcli remove\-member\fR [\-\-domain=domain\&.example\&.com] group user... .HP \w'\fBadcli\ preset\-computer\fR\ 'u \fBadcli preset\-computer\fR [\-\-domain=domain\&.example\&.com] computer... .HP \w'\fBadcli\ reset\-computer\fR\ 'u \fBadcli reset\-computer\fR [\-\-domain=domain\&.example\&.com] computer .HP \w'\fBadcli\ delete\-computer\fR\ 'u \fBadcli delete\-computer\fR [\-\-domain=domain\&.example\&.com] computer .SH "GENERAL OVERVIEW" .PP \fBadcli\fR is a command line tool that can perform actions in an Active Directory domain\&. Among other things it can be used to join a computer to a domain\&. .PP See the various sub commands below\&. The following global options can be used: .PP \fB\-D, \-\-domain=\fR\fB\fIdomain\fR\fR .RS 4 The domain to connect to\&. If a domain is not specified then the domain part of the local computer\*(Aqs host name is used\&. .RE .PP \fB\-R, \-\-domain\-realm=\fR\fB\fIREALM\fR\fR .RS 4 Kerberos realm for the domain\&. If not specified then the upper cased domain name is used\&. .RE .PP \fB\-S, \-\-domain\-controller=\fR\fB\fIserver\fR\fR .RS 4 Connect to a specific domain controller\&. If not specified then an appropriate domain controller is automatically discovered\&. .RE .PP \fB\-C, \-\-login\-ccache=\fR\fB\fI/path/to/file\fR\fR .RS 4 Use the specified kerberos credential cache to authenticate with the domain\&. If no file is specified or \fB\-C\fR is used, then the default kerberos credential cache will be used\&. .RE .PP \fB\-U, \-\-login\-user=\fR\fB\fIUser\fR\fR .RS 4 Use the specified user account to authenticate with the domain\&. If not specified then the name \*(AqAdministrator\*(Aq will be used\&. .RE .PP \fB\-\-no\-password\fR .RS 4 Don\*(Aqt show prompts for or read a password from input\&. .RE .PP \fB\-W, \-\-prompt\-password\fR .RS 4 Prompt for a password if necessary\&. This is the default\&. .RE .PP \fB\-\-stdin\-password\fR .RS 4 Read a password from stdin input instead of prompting for a password\&. .RE .PP \fB\-v, \-\-verbose\fR .RS 4 Run in verbose mode with debug output\&. .RE .SH "QUERYING DOMAIN INFORMATION" .PP \fBadcli info\fR displays discovered information about an Active Directory domain or an Active Directory domain controller\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli info domain\&.example\&.com \&.\&.\&. .fi .if n \{\ .RE .\} .sp .if n \{\ .RS 4 .\} .nf $ adcli info \-\-domain\-controller=dc\&.domain\&.example\&.com \&.\&.\&. .fi .if n \{\ .RE .\} .PP \fBadcli info\fR will output as much information as it can about the domain\&. The information is designed to be both machine and human readable\&. The command will exit with a non\-zero exit code if the domain does note exist or cannot be reached\&. .PP To show domain info for a specific domain controller use the \fB\-\-domain\-controller\fR option to specify which domain controller to query\&. .PP Use the \fB\-\-verbose\fR option to show details of how the domain is discovered and queried\&. Many of the global options, in particular authentication options, are not usable with the \fBadcli info\fR command\&. .SH "JOINING THE LOCAL MACHINE TO A DOMAIN" .PP \fBadcli join\fR creates a computer account in the domain for the local machine, and sets up a keytab for the machine\&. It does not configure an authentication service (such as \fBsssd\fR)\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli join domain\&.example\&.com Password for Administrator: .fi .if n \{\ .RE .\} .PP In addition to the global options, you can specify the following options to control how this operation is done\&. .PP \fB\-N, \-\-computer\-name=\fR\fB\fIcomputer\fR\fR .RS 4 The short non\-dotted name of the computer account that will be created in the domain\&. If not specified then the first portion of the \fB\-\-host\-fqdn\fR is used\&. .RE .PP \fB\-O, \-\-domain\-ou=\fR\fB\fIOU=xxx\fR\fR .RS 4 The full distinguished name of the OU in which to create the computer account\&. If not specified then the computer account will be created in a default location\&. .RE .PP \fB\-H, \-\-host\-fqdn=\fR\fB\fIhost\fR\fR .RS 4 Override the local machine\*(Aqs fully qualified domain name\&. If not specified the local machine\*(Aqs hostname will be retrieved via \fBgethostname()\fR\&. .RE .PP \fB\-K, \-\-host\-keytab=\fR\fB\fI/path/to/keytab\fR\fR .RS 4 Specify the path to the host keytab where host credentials will be written after a successful join operation\&. If not specified the default location will be used, usually /etc/krb5\&.keytab\&. .RE .PP \fB\-\-login\-type=\fR\fB\fI{computer|user}\fR\fR .RS 4 Specify the type of authentication that will be performed before creating the machine account in the domain\&. If set to \*(Aqcomputer\*(Aq then the computer must already have a preset account in the domain\&. If not specified and none of the other \fB\-\-login\-xxx\fR arguments have been specified, then will try both \*(Aqcomputer\*(Aq and \*(Aquser\*(Aq authentication\&. .RE .PP \fB\-\-os\-name=\fR\fB\fIname\fR\fR .RS 4 Set the operating system name on the computer account\&. The default depends on where adcli was built, but is usually something like \*(Aqlinux\-gnu\*(Aq\&. .RE .PP \fB\-\-os\-service\-pack=\fR\fB\fIpack\fR\fR .RS 4 Set the operating system service pack on the computer account\&. Not set by default\&. .RE .PP \fB\-\-os\-version=\fR\fB\fIversion\fR\fR .RS 4 Set the operating system version on the computer account\&. Not set by default\&. .RE .PP \fB\-\-service\-name=\fR\fB\fIservice\fR\fR .RS 4 Additional service name for a kerberos principal to be created on the computer account\&. This option may be specified multiple times\&. .RE .PP \fB\-\-user\-principal=\fR\fB\fIhost/name@REALM\fR\fR .RS 4 Set the userPrincipalName field of the computer account to this kerberos principal\&. If you omit the value for this option, then a principal will be set in the form of host/host\&.example\&.com@REALM .RE .PP \fB\-\-one\-time\-password\fR .RS 4 Specify a one time password for a preset computer account\&. This is equivalent to using \fB\-\-login\-type=computer\fR and providing a password as input\&. .RE .PP \fB\-\-show\-details\fR .RS 4 After a successful join print out information about join operation\&. This is output in a format that should be both human and machine readable\&. .RE .PP \fB\-\-show\-password\fR .RS 4 After a successful join print out the computer machine account password\&. This is output in a format that should be both human and machine readable\&. .RE .SH "UPDATING THE MACHINE ACCOUNT PASSWORD AND OTHER ATTRIBUTES" .PP \fBadcli update\fR updates the password of the computer account on the domain controller for the local machine, write the new keys to the keytab and removes older keys\&. It keeps the previous key on purpose because AD will need some time to replicate the new key to all DCs hence the previous key might still be used\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli update .fi .if n \{\ .RE .\} .PP If used with a credential cache other attributes of the computer account can be changed as well if the principal has sufficient privileges\&. .sp .if n \{\ .RS 4 .\} .nf $ kinit Administrator $ adcli update \-\-login\-ccache=/tmp/krbcc_123 .fi .if n \{\ .RE .\} .PP In addition to the global options, you can specify the following options to control how this operation is done\&. .PP \fB\-N, \-\-computer\-name=\fR\fB\fIcomputer\fR\fR .RS 4 The short non\-dotted name of the computer account that will be created in the domain\&. If not specified it will be retrieved from the keytab entries\&. .RE .PP \fB\-H, \-\-host\-fqdn=\fR\fB\fIhost\fR\fR .RS 4 The local machine\*(Aqs fully qualified domain name\&. If not specified the local machine\*(Aqs hostname will be retrieved from the keytab entries\&. .RE .PP \fB\-K, \-\-host\-keytab=\fR\fB\fI/path/to/keytab\fR\fR .RS 4 Specify the path to the host keytab where current host credentials are stored and the new ones will be written to\&. If not specified the default location will be used, usually /etc/krb5\&.keytab\&. .RE .PP \fB\-\-os\-name=\fR\fB\fIname\fR\fR .RS 4 Set the operating system name on the computer account\&. Not set by default\&. .RE .PP \fB\-\-os\-service\-pack=\fR\fB\fIpack\fR\fR .RS 4 Set the operating system service pack on the computer account\&. Not set by default\&. .RE .PP \fB\-\-os\-version=\fR\fB\fIversion\fR\fR .RS 4 Set the operating system version on the computer account\&. Not set by default\&. .RE .PP \fB\-\-service\-name=\fR\fB\fIservice\fR\fR .RS 4 Additional service name for a Kerberos principal to be created on the computer account\&. This option may be specified multiple times\&. .RE .PP \fB\-\-user\-principal=\fR\fB\fIhost/name@REALM\fR\fR .RS 4 Set the userPrincipalName field of the computer account to this Kerberos principal\&. .RE .PP \fB\-\-computer\-password\-lifetime=\fR\fB\fIlifetime\fR\fR .RS 4 Only update the password of the computer account if it is older than the lifetime given in days\&. By default the password is updated if it is older than 30 days\&. .RE .PP \fB\-\-show\-details\fR .RS 4 After a successful join print out information about join operation\&. This is output in a format that should be both human and machine readable\&. .RE .SH "CREATING A USER" .PP \fBadcli create\-user\fR creates a new user account in the domain\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli create\-user Fry \-\-domain=domain\&.example\&.com \e \-\-display\-name="Philip J\&. Fry" \-\-mail=fry@domain\&.example\&.com .fi .if n \{\ .RE .\} .PP In addition to the global options, you can specify the following options to control how the user is created\&. .PP \fB\-\-display\-name=\fR\fB\fI"Name"\fR\fR .RS 4 Set the displayName attribute of the new created user account\&. .RE .PP \fB\-O, \-\-domain\-ou=\fR\fB\fIOU=xxx\fR\fR .RS 4 The full distinguished name of the OU in which to create the user account\&. If not specified then the computer account will be created in a default location\&. .RE .PP \fB\-\-mail=\fR\fB\fIemail@domain\&.com\fR\fR .RS 4 Set the mail attribute of the new created user account\&. This attribute may be specified multiple times\&. .RE .PP \fB\-\-unix\-home=\fR\fB\fI/home/user\fR\fR .RS 4 Set the unixHomeDirectory attribute of the new created user account, which should be an absolute path to the user\*(Aqs home directory\&. .RE .PP \fB\-\-unix\-gid=\fR\fB\fI111\fR\fR .RS 4 Set the gidNumber attribute of the new created user account, which should be the user\*(Aqs numeric primary group id\&. .RE .PP \fB\-\-unix\-shell=\fR\fB\fI/bin/shell\fR\fR .RS 4 Set the loginShell attribute of the new created user account, which should be a path to a valid shell\&. .RE .PP \fB\-\-unix\-uid=\fR\fB\fI111\fR\fR .RS 4 Set the uidNumber attribute of the new created user account, which should be the user\*(Aqs numeric primary user id\&. .RE .SH "DELETING A USER" .PP \fBadcli delete\-user\fR deletes a user account from the domain\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli delete\-user Fry \-\-domain=domain\&.example\&.com .fi .if n \{\ .RE .\} .PP The various global options can be used\&. .SH "CREATING A GROUP" .PP \fBadcli create\-group\fR creates a new group in the domain\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli create\-group Pilots \-\-domain=domain\&.example\&.com \e \-\-description="Group for all pilots" .fi .if n \{\ .RE .\} .PP In addition to the global options, you can specify the following options to control how the group is created\&. .PP \fB\-\-description=\fR\fB\fI"text"\fR\fR .RS 4 Set the description attribute of the new created group\&. .RE .PP \fB\-O, \-\-domain\-ou=\fR\fB\fIOU=xxx\fR\fR .RS 4 The full distinguished name of the OU in which to create the group\&. If not specified then the group will be created in a default location\&. .RE .SH "DELETING A GROUP" .PP \fBadcli delete\-group\fR deletes a group from the domain\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli delete\-group Pilots \-\-domain=domain\&.example\&.com .fi .if n \{\ .RE .\} .PP The various global options can be used\&. .SH "ADDING A MEMBER TO A GROUP" .PP \fBadcli add\-member\fR adds one or more users to a group in the domain\&. The group is specified first, and then the various users to be added\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli add\-member \-\-domain=domain\&.example\&.com Pilots Leela Scruffy .fi .if n \{\ .RE .\} .PP The various global options can be used\&. .PP .SH "REMOVING A MEMBER FROM A GROUP" .PP \fBadcli remove\-member\fR removes a user from a group in the domain\&. The group is specified first, and then the various users to be removed\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli remove\-member \-\-domain=domain\&.example\&.com Pilots Scruffy .fi .if n \{\ .RE .\} .PP The various global options can be used\&. .SH "PRESET COMPUTER ACCOUNTS" .PP \fBadcli preset\-computer\fR pre\-creates one or more computer accounts in the domain for machines to later use when joining the domain\&. By doing this machines can join using a one time password or automatically without a password\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli preset\-computer \-\-domain=domain\&.example\&.com \e host1\&.example\&.com host2 Password for Administrator: .fi .if n \{\ .RE .\} .PP If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names\&. The computer accounts must not already exist\&. .PP In addition to the global options, you can specify the following options to control how this operation is done\&. .PP \fB\-O, \-\-domain\-ou=\fR\fB\fIOU=xxx\fR\fR .RS 4 The full distinguished name of the OU in which to create the computer accounts\&. If not specified then the computer account will be created in a default location\&. .RE .PP \fB\-\-one\-time\-password\fR .RS 4 Specify a one time password to use when presetting the computer accounts\&. If not specified then a default password will be used, which allows for later automatic joins\&. .RE .PP \fB\-\-os\-name=\fR\fB\fIname\fR\fR .RS 4 Set the operating system name on the computer account\&. The default depends on where adcli was built, but is usually something like \*(Aqlinux\-gnu\*(Aq\&. .RE .PP \fB\-\-os\-service\-pack=\fR\fB\fIpack\fR\fR .RS 4 Set the operating system service pack on the computer account\&. Not set by default\&. .RE .PP \fB\-\-os\-version=\fR\fB\fIversion\fR\fR .RS 4 Set the operating system version on the computer account\&. Not set by default\&. .RE .PP \fB\-\-service\-name=\fR\fB\fIservice\fR\fR .RS 4 Additional service name for a kerberos principal to be created on the computer account\&. This option may be specified multiple times\&. .RE .PP \fB\-\-user\-principal\fR .RS 4 Set the userPrincipalName field of the computer account to this kerberos principal in the form of host/host\&.example\&.com@REALM .RE .SH "RESET COMPUTER ACCOUNT" .PP \fBadcli reset\-computer\fR resets a computer account in the domain\&. If a the appropriate machine is currently joined to the domain, then its membership will be broken\&. The account must already exist\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli reset\-computer \-\-domain=domain\&.example\&.com host2 .fi .if n \{\ .RE .\} .PP If the computer names specified contain dots, then they are treated as fully qualified host names, otherwise they are treated as short computer names\&. .PP In addition to the global options, you can specify the following options to control how this operation is done\&. .PP \fB\-\-login\-type=\fR\fB\fI{computer|user}\fR\fR .RS 4 Specify the type of authentication that will be performed before creating the machine account in the domain\&. If set to \*(Aqcomputer\*(Aq then the computer must already have a preset account in the domain\&. If not specified and none of the other \fB\-\-login\-xxx\fR arguments have been specified, then will try both \*(Aqcomputer\*(Aq and \*(Aquser\*(Aq authentication\&. .RE .SH "DELETE COMPUTER ACCOUNT" .PP \fBadcli delete\-computer\fR deletes a computer account in the domain\&. The account must already exist\&. .sp .if n \{\ .RS 4 .\} .nf $ adcli delete\-computer \-\-domain=domain\&.example\&.com host2 Password for Administrator: .fi .if n \{\ .RE .\} .PP If the computer name contains a dot, then it is treated as fully qualified host name, otherwise it is treated as short computer name\&. .PP If no computer name is specified, then the host name of the computer adcli is running on is used, as returned by gethostname()\&. .PP The various global options can be used\&. .SH "BUGS" .PP Please send bug reports to either the distribution bug tracker or the upstream bug tracker at \m[blue]\fBhttps://bugs\&.freedesktop\&.org/enter_bug\&.cgi?product=realmd&component=adcli\fR\m[] .SH "SEE ALSO" \fBrealmd\fR(8), \fBnet\fR(8), \fBsssd\fR(8) .PP Further details available in the realmd online documentation at \m[blue]\fBhttp://www\&.freedesktop\&.org/software/realmd/\fR\m[]