TrueNAS CORETrueNAS CORE Nightly Development Documentation
This content follows experimental early release software. Use the Product and Version selectors above to view content specific to a stable software release.

Active Directory Screen

The Active Directory (AD) service shares resources in a Windows network environment. Go to Directory Services > Active Directory to set up AD on TrueNAS. The first Active Directory screen is a list of basic options.


Basic Options


Domain NameEnter the Active Directory domain ( or child domain ( Required field.
Domain Account NameEnter the Active Directory administrator account name. Required field.
Domain Account PasswordEnter the password for the Active Directory administrator account. Required when configuring a domain for the first time. After initial configuration, the password is not needed to edit, start or stop the service.
Enable (requires password or Kerberos principle)Enable the Active Directory services. Must enter the Domain Account Password when selecting this option for the first time.

Click ADVANCED OPTIONS to access extra options shown below.

Click REBUILD DIRECTORY SERVICE CACHE to resync the cache if it becomes out of sync. Or if fewer users than expected are available or visible in the permissions editors.

Advanced Options


Verbose loggingSelect to log attempts to join the domain to /var/log/messages.
Allow Trusted DomainsSelected if you do not want the username to include a domain name. Clear the checkbox to force the domain names to be prepended to usernames. One possible reason to not select this value is to prevent username collisions when this is selected and there are identical usernames across multiple domains.
Use Default DomainLeave checkbox clear to prepend the domain name to the user name. When not selected prevents name collisions when Allow Trusted Domains is set and multiple domains use the same user name.
Allow DNS UpdatesSelect to enable Samba to do DNS updates when joining a domain.
Disable FreeNAS CacheSelect to disable caching AD users and groups. This can help when unable to bind to a domain with a large number of users or groups.
Restrict PAMSelect to restrict SSH access in certain circumstances. When selected only members of BUILTIN\Administrators have SSH access.
Site NameEnter the relative distinguished name of the site object in the Active Directory.
Kerberos RealmSelect an existing realm added in Directory Services > Kerberos Realms.
Kerberos PrincipalSelect the location of the principal in the keytab. Keytab created in Directory Services > Kerberos Keytabs.
Computer Account OUThe organizational unit where new computer accounts get created. OU strings read from top to bottom without RDNs. Use slashes (/) as delimiters, like Computers/Servers/NAS. Use the backslash (\) to escape characters but not as a separator. Backslash interpretation takes place at many levels. Backslashes might need doubling or even quadrupling to take effect. When left blank, new computer accounts get created in the Active Directory default OU.
AD TimeoutNumber of seconds before timeout. To view the AD connection status, open the interface Task Manager.
DNS TimeoutNumber of seconds before a timeout. Increase this value if AD DNS queries time out.
Winbind NSS InfoSelect the schema to use when querying AD for user/group info from the dropdown list. rfc2307 uses the schema support included in Windows 2003 R2. sfu is for Service For Unix 3.0 or 3.5. sfu20 is for Service For Unix 2.0.
Netbios NameThe Netbios name of this NAS is truenas. This name must differ from the Workgroup name and be no greater than 15 characters.
NetBIOS aliasAlternative names that SMB clients can use when connecting to this NAS. Can be no greater than 15 characters.
LEAVE DOMAINDisconnects the TrueNAS system from the Active Directory.

Click SAVE to save settings.

Click BASIC OPTIONS to return to the Active Directory display of basic options only.

Click EDIT IDMAP to navigate to the Directory Services > Idmap screen.

Click REBUILD DIRECTORY SERVICE CACHE to resync the cache if it becomes out of sync. Or if fewer users than expected are available in the permissions editors.