Windowsクライアント、サーバーをドメインに参加させる

はじめに

Samba Active Directory（AD）またはSamba NT4ドメインを設定したら、マシンをドメインに参加させる必要があります。 ドメインに参加しているマシンだけがドメインリソースを使用できるようになります。 参加中、ドメイン内にマシンアカウントが作成され、コンピュータをメンバーとして認証します。

Windows Serverをドメインコントローラ（DC）としてADに参加させる場合は、以下を参照してください：

• Windows Server 2008/2008 R2のSamba ADへの参加
• Windows Server 2012/2012 R2のSamba ADへの参加

WindowsクライアントまたはサーバーオペレーティングシステムをドメインメンバーとしてSamba ADまたはSamba NT4ドメインに参加させるには、このドキュメントを使用してください。

システム要件

サポートされているWindowsのバージョン

ドメインに参加するには、Windowsのエディションに対応する機能が必要です。 ドメインメンバーとして、次のWindowsオペレーティングシステムに参加できます：

ワークステーションのエディション:

• Windows 10: Pro, Enterprise, and Education
• Windows 8 and 8.1: Pro and Enterprise
• Windows 7: Professional, Ultimate, and Enterprise
• Windows Vista: Business, Ultimate, and Enterprise
• Windows XP: Professional
• Windows 2000: Professional
• Windows NT4 (only NT4 domain support)

サーバー(全エディション):

• Windows Server 2016
• Windows Server 2012 and 2012R2
• Windows Server 2008 and 2008R2
• Windows Server 2003 and 2003R2
• Windows Server 2000

Permissions

To join a machine to a domain you require:

• local administrator permissions on the computer you want to join
• credentials of a domain account that is enabled to join machines to the domain. For example:
  • the domain administrator account
  • an account with delegated permissions (AD only)

Note, that in an AD authenticated user accounts are enabled to join up to 10 machines to the domain, if the administrator has not disabled the feature. See https://support.microsoft.com/kb/243327/en

Required Settings for NT4 Domains

If you are joining the host to a Samba NT4 domain, some Windows operating systems require modifications. See Required Settings for Samba NT4 domain.

DNS Settings (AD only)

In an Active Directory (AD), a working DNS configuration is indispensable. AD uses DNS to locate domain controllers (DC), resolve host names, and for many other tasks. Ensure that the client has at least one DNS server configured, that is able to resolve the AD DNS zone. For further information, see DNS Configuration on Windows Hosts.

Date and Time Settings (AD only)

Active Directory uses Kerberos for authentication. Kerberos requires that the domain member and the domain controllers (DC) are having a synchronous time. If the difference exceeds 5 minutes (default), the client is not able to access domain resources for security reasons.

Before you join the domain, check the time configuration:

• Open the Control Panel.

• Navigate to Clock, Language and Region.

• Click Date and Time.

• Verify the date, time, and time zone settings. Adjust the settings, if necessary.

• Click OK to save the changes.

Joining a Windows Client or Server to a Domain

• Open the Control Panel.

• Navigate to System and Security / System.

• Click Change settings, next to the computer name.

• On the Computer Name tab, click the Change button.

• Verify the computer name. If you rename the computer, reboot before joining the domain.

• Select Domain, enter the name of your domain, and click OK.

ファイル:Join Enter Domain Name.png

Active Directory (AD) only: You can enter the NetBIOS name of the domain, if your client is able to resolve it. For example: samdom instead of samdom.example.com.

• Enter the credentials of an account that is able to join a computer to the domain. For example, the domain administrator account. Click OK to continue.

• Reboot the computer after the computer successfully joined the domain.

---