Updated: 29 September 2026 · Applies to: realmd 0.17 with SSSD 2.9 to 2.12 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13
realmd joins a Linux server to a Microsoft Active Directory (AD) domain with a few commands. It configures SSSD, Kerberos and the system's login settings, so domain users can log in with their AD user name and password, and you can decide which AD groups may log in. We checked the packages and commands on AlmaLinux 9 and 10 and Ubuntu 24.04; joining itself needs a real domain.
Before you start
- The server must resolve the domain's DNS: use the AD domain controllers as DNS servers (or forward the AD zone to them). Test with
host -t SRV _ldap._tcp.ad.example.com. - The clocks must agree within five minutes: run chrony and sync with the domain controllers or the same time source.
- You need an AD account that may join computers to the domain.
- Give the server a proper host name, for example
hostnamectl set-hostname web01.ad.example.com.
1. Install the packages
# AlmaLinux, Rocky Linux, RHEL dnf install realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools krb5-workstation # Ubuntu, Debian apt install realmd sssd sssd-tools libnss-sss libpam-sss adcli samba-common-bin oddjob oddjob-mkhomedir packagekit
2. Discover the domain
realm discover ad.example.com
The output shows the domain type (active-directory), and whether the required packages are installed.
3. Join
realm join -U Administrator ad.example.com
Use any AD account that may join computers, instead of Administrator. To place the computer account in a specific organisational unit, add --computer-ou="OU=Servers,DC=ad,DC=example,DC=com". realmd configures SSSD and, on AlmaLinux, Rocky Linux and RHEL, selects the SSSD profile in authselect.
4. Create home folders at first login
authselect enable-feature with-mkhomedir # AlmaLinux, Rocky Linux, RHEL systemctl enable --now oddjobd pam-auth-update --enable mkhomedir # Ubuntu, Debian
5. Test
realm list id jsmith@ad.example.com ssh jsmith@ad.example.com@web01.ad.example.com
To log in with the short name (jsmith) instead, set use_fully_qualified_names = False in the domain section of /etc/sssd/sssd.conf and restart SSSD with systemctl restart sssd.
6. Limit who may log in
By default, every domain user may log in. Allow only specific groups:
realm deny --all realm permit -g "Linux Admins"
For sudo rights, create a file in /etc/sudoers.d/, for example %linux\ admins@ad.example.com ALL=(ALL) ALL, and check it with visudo -c.
Leave the domain
realm leave ad.example.com
Official documentation: RHEL 9: connecting to AD using SSSD and realm manual.
