一、搭建域主机的好处：

1，简化管理工作。

2，单个帐户登陆后，可以访问域中所有有权访问的资源。

3，具有强大的查询功能。

二、域主机的构建：(windows2012 r2)

https://jingyan.baidu.com/article/acf728fd4a7f80f8e410a353.html

这里有详细的配制方法。

三、服务器加域。(我们的dns：10.0.0.8 域ip：test.com)

windows服务器加域的方法：

a:在IPV4属性那里，选Advance->DNS，

b：DNS Server添加10.0.0.8

c:Append these DNS suffixes那里添加tcminplay.local

d： System->Advanced system settings->Computere Name

e:点change。修改名字和输入域ip(接下来需要输入域主机的管理员帐号和密码)

f：添加远程登录域账户：System->Advanced system settings->Remote->Select Users ->Add ->Advanced...->输入域管理员用户名和密码 -->Find Now -> 找到 管理员用户 添加

linux服务器加域的方法：

a：安装必须的软件包

yum install krb5-libs krb5-devel pam_krb5 krb5-workstation krb5-auth-dialog

yum install samba-winbind samba samba-common samba-client samba-winbind-clients

b：修改三个配置文件

cat /etc/samba/smb.conf

[global]

workgroup = TEST 必须大写

security = ADS

idmap uid = 16777216-33554431

idmap gid = 16777216-33554431

password server = 10.0.0.8

map to guest = bad user

encrypt passwords =yes

realm = TEST.COM 必须大写

winbind use default domain = yes

template homedir = /home/%D/%U

template shell = /bin/bash

[homes]

comment = %S

path =/home/%D/%S

writeable = yes

browsable = yes

; valid users = %S

valid users = CAMPUS\%S

cat /etc/krb5.conf

includedir /etc/krb5.conf.d/

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = TEST.COM 必须大写

dns_lookup_kdc = true

dns_lookup_realm = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = yes

rdns = false

default_ccache_name = KEYRING:persistent:%{uid}

[realms]

TEST.COM = {

kdc = 10.0.0.81:88

admin_server = 10.0.0.8:749

default_domain = TEST.COM 必须大写

}

[domain_realm]

.test.com = TEST.COM 必须大写

test.com = TEST.COM 必须大写

cat /etc/nsswitch.conf

...

passwd: files winbind

shadow: files winbind

group: files winbind 只需要修改这里

...

c:重启samba服务，重启winbind服务。

/bin/systemctl restart samba.service

/bin/systemctl start winbind.service

d：验证 ：

kinit administrator@TEST.COM 成功会提示输入密码(域主机的管理员密码)

e：加域

net ads join -S 10.0.0.8 -U Administrator

输入密码 无报错则加域成功