What are the requirements for configuring a Samba file server to work in Active Directory mode? (Choose THREE correct answers.)

Brenda K.Jun 3, 2026

A, B, and D are your three picks, and here is why each one earns its spot. Joining Active Directory means Samba needs to know the Kerberos realm, so you declare it in smb.conf with a line like "realm = YOURDOMAIN.COM" alongside "security = ADS", that is option A. Time sync is non-negotiable in Kerberos environments because tickets expire based on clock values, and any drift beyond five minutes causes authentication failures, so B is mandatory before you even attempt to join. The actual domain join happens with "net ads join -U Administrator", which is D, and that command registers the machine account in AD and pulls down the necessary credentials. C is a trap. pdbedit manages the local Samba password database (the TDB backend), which is irrelevant when AD is handling authentication. You are not building local accounts when you are delegating auth to the domain controller. E is a double trap because the command syntax is wrong and the flag is fictional, winbindd does run in ADS mode but you configure that through smb.conf, not a command-line flag like that. Quick win or time sink: this is a quick win. Recognize the Kerberos time-sync rule and the net ads join command, confirm the realm line in smb.conf, and move on. Do not spend more than 60 seconds here.

Fatima Z.Jun 26, 2026

Yes, A, B, and D are your three, and here is the sticky hook to remember them: think "RTJ" like "Ready To Join" because you need the Realm in smb.conf, Time synced via NTP, and the Join command "net ads join" to actually bring the server into AD. Kerberos, which Active Directory runs on, will flat-out refuse tickets if your clock skew is more than five minutes off the domain controller, so B is not optional, it is survival. C trips people up because pdbedit manages local Samba user databases like tdbsam, which is the passdb style, not the AD style where users live in the directory itself. E is a distractor with a misspelling and a fake flag, so picture a "windbag" blowing hot air to remind yourself that windbindd with that bogus "-krb5" switch is just noise on this exam.

Samuel O.Jun 26, 2026

Took this one on my 117-302 sitting last spring and it tripped me up for a second because C looks plausible if you've been living in workgroup mode where you're doing everything locally with pdbedit. But in ADS mode you're handing off authentication to Active Directory, so you don't create local admin accounts, you join the domain with net ads join and let AD own the identity store. The realm line in smb.conf is what tells Samba which Kerberos realm to target, and time sync is non-negotiable because Kerberos has a five-minute clock skew tolerance before it just refuses tickets outright. I had a box in a lab once where NTP drifted six minutes overnight and every single AD auth started failing until I figured out why, so that B answer is burned into my brain permanently. Option E is a trap because the daemon is winbindd not windbindd, and ADS mode is configured in smb.conf under security = ADS, not through a command-line flag on the daemon itself.

Ingrid P.Jun 16, 2026

I kept second-guessing myself on C because pdbedit is a real Samba tool I use constantly, so it felt like it belonged here, but the question is specifically about AD mode requirements, and in AD mode you are not managing local Samba accounts with pdbedit at all, the domain controller handles authentication. What locked in A, B, and D for me was thinking through the actual join process: smb.conf needs the realm line pointing to your AD domain, Kerberos tickets will fail silently if your clock is off by more than five minutes, and net ads join is the literal command that registers the machine in AD. Option E tripped me up for a second because winbindd does run in ADS mode in practice, but the syntax shown is wrong and winbindd is not a requirement for the join itself, it comes into play later for ID mapping. Make cards for the five-minute Kerberos clock skew rule and the exact net ads join syntax separately, those two facts show up across multiple Samba questions and they are easy to confuse under pressure.