How to join a linux computer to an active directory domain

Here's the standard approach using realmd/sssd, which works on most modern distros (RHEL/CentOS/Rocky, Ubuntu, Debian, SUSE):

1. Prerequisites

DNS must resolve to your AD domain controllers (add them to /etc/resolv.conf or your DHCP config if not already).
Time must be in sync with the domain (Kerberos requires this — install/enable chronyd or ntpd).
You need an AD account with permission to join computers to the domain.

RHEL/CentOS/Rocky/Fedora:

sudo dnf install realmd sssd sssd-tools samba-common-tools oddjob oddjob-mkhomedir adcli krb5-workstation

Ubuntu/Debian:

sudo apt install realmd sssd sssd-tools samba-common-bin oddjob oddjob-mkhomedir adcli krb5-user packagekit

sudo realm discover example.com

This confirms DNS/connectivity and shows what realmd detected.

sudo realm join example.com -U your_admin_user

It will prompt for the AD account's password. Use -U with an account that has domain-join rights (Domain Admin, or a delegated account).

Optional flags:

--computer-ou="OU=Linux,OU=Servers,DC=example,DC=com" — join into a specific OU
--os-name / --os-version — set what shows up in AD's computer object attributes

realm list
id AD_USER@example.com
getent passwd AD_USER@example.com

By default realm join restricts login to no one. To permit access:

sudo realm permit -g "Domain Users@example.com"
# or permit everyone:
sudo realm permit --all

Enable auto-creation of home dirs on first login:

sudo authselect enable-feature with-mkhomedir   # RHEL8+/Fedora
# or for Ubuntu:
sudo pam-auth-update --enable mkhomedir

If realm discover fails, check /etc/resolv.conf points at an AD DNS server, and that _ldap._tcp.example.com SRV records resolve (dig SRV _ldap._tcp.example.com).
If join fails on Kerberos, check clock skew (chronyc tracking / timedatectl).
Logs: journalctl -u sssd and sudo realm join -v ... for verbose output.