Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-2821: AD Join Assistant will not accept domain admin credentials.

Mac & PC Management Service ,  

12 April,16 at 11:46 AM

Applies to: Centrify DirectControl 5.1.0 for Mac OS X only.
After entering AD domain admin credentials into the second screen of the AD Join Assistant, pressing "Continue" results in one of the following error messages:
Validation of username, password, and domain failed with this error: 
get user credentials: Preauthentication failed
Validation of username, password, and domain failed with this error: 
error during execution: wrong # args: should be [-gc] [-write] [-machine] <[server@domain> [<user> [<password>]]
The domain admin credentials have been double-checked to be correct and the account has not expired. 
Using the command-line adjoin method to join the Mac with the same credentials passes through successfully.
The above error prompts may show if the domain admin password contains any of the following characters:
- a dash character (-)
- a dollar sign ($)
- a space character ( )
- an ampersand (&)
The preauthentication interprets these characters incorrectly and throws up a false-positive when verifying the validity of the entered credentials.
There are three workarounds to this issue;
- Option 1:
Avoid the use of the above characters within the domain admin password. 
- Option 2:
Use the command-line adjoin method to join the computers to the domain:
First enable licensed features:
  sudo adlicense -l 
Then join the domain in the selected mode (either Auto Zone or Zone Mode).
To join the domain in Auto Zone mode: 
  sudo /usr/sbin/adjoin --user Administrator --container "" --name ComputerName --workstation 
To join the domain in Zone Mode: 
  sudo /usr/sbin/adjoin --user Administrator --container "" --name ComputerName --zone ZoneName 
- Option 3:
Download the 5.0.3 version of the GUI front-end (attached below) and use that to join to the domain. The agent will still be using the 5.1.0 binaries to join and communicate with Active Directory.
This will be fixed in the 5.1.1 release of the AD Join Assistant.
This issue strictly related to the GUI itself and is not a network configuration or an AD account problem.

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.