This makes sense.  adcli update, with the Kerberos creds of the original principal that's allowed to create new machine accounts in that OU in the first place.

As it turns out, I must have powered up that VM just under the wire.  (I believe our AD policy is to lock machine accounts after 40 days.)  So once I powered it up, I had to come in as root and do a 'systemctl restart sssd', then all was good.  And still is good.

I didn't have to re-joint or update machine password after all.

Spike


On Tue, Oct 9, 2018 at 3:33 AM John Hearns <hearnsj@googlemail.com> wrote:
Spike,   the machine will always have an account in the AD Realm.
So no, you do not have to leave and re-join. What DOES time out is the password.
sssd should renew the password periodcially (*) when it is running. As
you say you have had > 30 days of downtime

You can use the msktutil  to reset a password
https://fuhm.net/software/msktutil/manpage.html#PASSWORD EXPIRY

(*) you can change this periddicity in sssd - and can turn it down to
a very shirt time, for debugging.
One of the parameters is also 'how soon after startup should I look at
the age of the password









On Mon, 8 Oct 2018 at 15:16, Spike White <spikewhitetx@gmail.com> wrote:
>
> All,
>
> I had a VM down for a great number of days.  Apparently, it was not 30 days.  Because even though it initially didn't correct do AD authentication, I fixed one misconfiguration in /etc/krb5.conf, restarted SSSD and it did.
>
> But that raises a bigger question.  If it's been >30 days and my machine account is no longer valid, how do I rejoin the domain?
>
> Is it:
>    realm leave (no flags)
>    readlm join (with all my usual flags that I use on the initial realm join)
>
> Spike
> _______________________________________________
> sssd-users mailing list -- sssd-users@lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org
_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org