Why can’t join AD on QSM3 and QSM4 NAS? #
This might be casued by the AD domain type(RWDC/RODC/GC). Please ensure customer AD domain type is RWDC.
GC (Global Catalog) cannot be used independently as a domain controller for NAS to join an AD (Active Directory) domain. Typically, a fully functional domain controller is required for a NAS to join an AD domain, not just a GC. The reasons are as follows:
GC is primarily used for cross-domain queries and authentication. It stores a partial set of attributes for all AD objects, rather than complete data. The role of GC is to improve the efficiency of cross-domain searches and authentication in an AD environment, but it does not manage devices joining and synchronizing within the domain, such as NAS.
To ensure that the NAS device can properly join the AD domain and perform all of its functions (such as user authentication, access control, and share management), it is recommended to use a Read-Write Domain Controller (RWDC). While GC may run as a role on a domain controller, the key requirement for NAS to join AD is RWDC, not GC.
Although GC can speed up cross-domain queries and authentication, it cannot be used alone as a domain controller for NAS to join an AD domain. You should use a fully functional Read-Write Domain Controller (RWDC) to handle the NAS AD join process.
How to check if AD server is RODC? #
- Open Windwos powershell with administrator in AD server
- Run command “Get-ADDomainController -Filter * | Select-Object Name, IsReadOnly”
- Check the output, if all show false means RWDC, if one of them show true, it means RODC.
The port numbers required for joining an AD domain #
Both QSM4 and QSM3 join the AD domain using the SMB protocol, so they use the same ports as SMB: ports 137, 138, 139, and 445.
Why is the AD user suddenly unable to access the SMB share? #
Please check the system time on both the NAS and the AD server. If the time difference exceeds 5 minutes, it may likely cause issues with SMB access. This not only affects AD users but may also prevent local users such as “admin” from accessing the share. In some cases, the login prompt for entering username and password may not appear at all.
