nerdexam
CompTIA

LX0-104 · Question #132

After finishing configuring of a Unix client to authenticate with a Microsoft Active Directory server, login attempts are unsuccessful. Which of the following is most likely the cause?

The correct answer is B. The PAM library is searching the directory with the default search filter. If a Unix client fails to authenticate with Active Directory after configuration, it is most likely because the PAM library is using a default search filter that doesn't match Active Directory's object attributes. Active Directory often requires specific LDAP search filters for…

Administrative Tasks

Question

After finishing configuring of a Unix client to authenticate with a Microsoft Active Directory server, login attempts are unsuccessful. Which of the following is most likely the cause?

Options

  • AUnix Client support is disabled in the Active Directory configuration.
  • BThe PAM library is searching the directory with the default search filter.
  • CThe slapd daemon is not running.
  • DThe user account in Active Directory has the remote login setting disabled.

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    78% (21)
  • C
    7% (2)
  • D
    11% (3)

Why each option

If a Unix client fails to authenticate with Active Directory after configuration, it is most likely because the PAM library is using a default search filter that doesn't match Active Directory's object attributes. Active Directory often requires specific LDAP search filters for user lookups.

AUnix Client support is disabled in the Active Directory configuration.

While Active Directory has settings, a general 'Unix Client support' being disabled is not a common specific configuration that would solely cause authentication failure in this manner, as integration is usually handled via standard LDAP/Kerberos protocols.

BThe PAM library is searching the directory with the default search filter.Correct

When integrating a Unix client with Active Directory, the default LDAP search filters used by PAM or NSS modules may not correctly identify users in the Active Directory schema, which often uses different attribute names (e.g., `sAMAccountName` instead of `uid`) or object classes. This mismatch prevents successful authentication and requires adjusting the search filter in the client's LDAP configuration.

CThe slapd daemon is not running.

`slapd` is the OpenLDAP daemon; Active Directory uses its own directory service, so `slapd` would not be running or relevant for AD authentication.

DThe user account in Active Directory has the remote login setting disabled.

While user accounts in AD can have login restrictions, it's less likely to be the *first* debugging step than checking the core LDAP communication and search filters, especially if no specific 'remote login disabled' error is reported.

Concept tested: Unix-AD authentication troubleshooting

Source: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-active-directory-schema

Topics

#Unix authentication#Active Directory#PAM#LDAP#troubleshooting

Community Discussion

No community discussion yet for this question.

Full LX0-104 Practice