tune_sssd.sh: fix net ads join/leave options

dc-client/tune_sssd.sh

@@ -200,14 +200,15 @@ if net ads testjoin 2>/dev/null; then
     fi
 else
     echo "Machine account is broken or not joined, (re)joining..."
-    # Leave domain first if there's a stale join
-    net ads leave --use-kerberos=required 2>/dev/null || true
+    # Leave domain first if there's a stale join (use admin ticket from kinit)
+    net ads leave 2>/dev/null || true
     [ -f /etc/krb5.keytab ] && echo "Removing old keytab /etc/krb5.keytab ..." && rm -fv /etc/krb5.keytab
 
     echo "Join to domain... "
     # Use dnshostname= to register full FQDN (e.g. host.office.etersoft.ru instead of host.etersoft.ru)
     # This requires msDS-AllowedDNSSuffixes to include the DNS subdomain on the DC
-    net ads join dnshostname=$(hostname -f) --use-kerberos=required --no-dns-updates || fatal "Failed to join to the domain '$REALM'"
+    # Note: --use-kerberos=required doesn't work here, need explicit -U for credentials
+    net ads join dnshostname=$(hostname -f) -U $ADMIN --no-dns-updates || fatal "Failed to join to the domain '$REALM'"
 fi
 
 kdestroy