Offline Windows AD domain join tool for Samba

Implements a custom smb-net-ads-join utility, which performs the same operation as net ads join Samba command, but works completely offline.

To join a Samba system to an AD domain it needs SYSTEM, SECURITY and SAM registry hive files from a Windows system that is already joined to the same domain.

Usage

usage: smb-net-ads-join [-h] [-v] [-V] [-J] [-o FILE] DIR

positional arguments:
  DIR                   Windows registry hive files directory (e.g. '/Windows/System32/config')

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         print intermediate results and debug info
  -V, --version         show program's version number and exit
  -J, --json            generate 'secrets.json' file in place of 'secrets.tdb'
  -o FILE, --output FILE
                        generated 'secrets.tdb' file name and location

Example invocation

Assuming that Windows drive C:\ is mounted to /mnt/windows/:

$ smb-net-ads-join /mnt/windows/Windows/System32/config
Using short domain name -- DOMAIN
Joined 'HOSTNAME' to realm 'domain.company.com'

A new database file secrets.tdb is created in the current directory.

It must be placed into /var/lib/samba/private/ and, with an appropriate smb.conf configuration, winbindd will run as if net ads join command was executed.

Common errors

When the Windows machine is not joined to an ADS domain:

$ smb-net-ads-join /mnt/windows/Windows/System32/config
WARNING:smbjoin.cli:Registry hive access failed: Did not find $MACHINE.ACC at Policy
CRITICAL:smbjoin.cli:Extracting secrets failed: Machine account password key does not exist
error: Domain machine account data was not found in the registry