Local root accounts on a hundred iDRACs are a password rotation problem nobody wants. Pointing them at Active Directory instead moves the accounts, the group membership and the offboarding to where they already live. The iDRAC web interface can do it one server at a time; RACADM can do it to all of them in a loop.
This guide assumes you have already installed Dell iDRAC Tools with the RACADM utility on your system. Below are the minimum commands needed to configure directory authentication, then the script that applies them at scale.
Prerequisites, in the order they bite
- The AD groups have to exist first. Create
iDRAC-ReadOnlyandiDRAC-Administrator(or your own names) and put users in them. Configuring an iDRAC to trust a group that does not exist fails silently at login time, not at configuration time. - DNS must resolve your domain's service records.
DCLookupEnablemeans the iDRAC finds its domain controllers by SRV lookup, so the DNS servers configured on the iDRAC NIC have to be the ones that serve your AD zone. A public resolver here is the single most common reason this whole procedure appears to do nothing. - Time has to be close. Kerberos and certificate validation both care. If the iDRAC clock is far off, logins fail with no useful message.
- The iDRAC needs network reachability to a domain controller — TCP 389/636 for LDAP and 3268/3269 for the Global Catalog.
DCLookupEnablefinds them through the standard AD DNS service records, so this is a DNS dependency before it is a routing one.
Everything below was run against iDRAC9. The attribute names have been stable across recent generations, but the privilege bitmask in particular is the part most worth re-checking if your fleet is older.
Configure Active Directory on one server
Replace domain.local with your own domain and 192.168.10.1 with the iDRAC address:
# Enable Global Catalog lookup (so iDRAC can query AD via GC)
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.GCLookupEnable Enabled
# Set the root domain for Global Catalog
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.GCRootDomain domain.local
# Enable Domain Controller (DC) lookup
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.DCLookupEnable Enabled
# Allow DC lookup by user domain
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.DCLookupByUserDomain Enabled
# Specify the AD domain name for DC lookup
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.DCLookupDomainName domain.local
# Disable certificate validation (useful if your DC uses self-signed certs)
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.CertValidationEnable Disabled
# Define the first user domain entry
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.UserDomain.1.Name domain.local
# Map AD group "iDRAC-ReadOnly" to the domain and assign minimal privileges (0x1 = login only)
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.1.Domain domain.local
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.1.Name iDRAC-ReadOnly
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.1.Privilege 0x1
# Map AD group "iDRAC-Administrator" to the domain and assign full privileges (0x1ff = administrator)
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.2.Domain domain.local
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.2.Name iDRAC-Administrator
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ADGroup.2.Privilege 0x1ff
# Enable Active Directory authentication on iDRAC
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.Enable Enabled
# Set schema type: 2 = Standard Schema (no AD schema extensions)
racadm --nocertwarn -r 192.168.10.1 -u root -p 'pass' set iDRAC.ActiveDirectory.Schema 2
What the options mean
--nocertwarn— suppresses the warning about the iDRAC's own self-signed certificate. It silences a message; it does not turn off encryption.-r <ip_address>— the target iDRAC address.-u <username> -p <password>— credentials for the remote iDRAC. Passing a password on the command line puts it in your shell history and in the process list;-iprompts for both instead, and is what you want for anything you are not scripting.Schema 2— Standard Schema. The iDRAC matches AD groups you nominate and applies the privilege mask you set here. The alternative, Extended Schema, requires extending the Active Directory schema itself with Dell objects — more granular, far more invasive, and rarely worth it.
iDRAC.ADGroup.N.Privilege bitmask values
iDRAC.ADGroup.N.Privilege is a bitmask, so a group gets exactly the rights you add up:
| Value | Effect |
|---|---|
0x0 |
no access — the group is defined but cannot log in |
0x1 |
login only, which is what a read-only group should have |
0x1ff |
every privilege, i.e. administrator |
These are the commonly documented iDRAC7/8/9 values rather than something I found in a current Dell table, and bitmasks differ between generations — so confirm the intermediate values on your own controller with racadm help set iDRAC.ADGroup.1.Privilege rather than assuming, and prove the semantics with a real login rather than with a successful set. The two ends of the range above are the ones you need for a read-only and an administrator group.
About CertValidationEnable Disabled
This is the line to think about rather than copy. Disabling certificate validation means the iDRAC will talk LDAP to whatever answers as a domain controller without checking that it really is one. It is a pragmatic setting on an isolated management network with an internal CA nobody has exported yet — it is not a good permanent state.
The proper version is to upload your CA certificate to each iDRAC and leave validation on:
# -t 2 = CA certificate for Directory Service
racadm --nocertwarn -r 192.168.10.1 -i sslcertupload -t 2 -f /path/to/ca-root.cer
racadm --nocertwarn -r 192.168.10.1 -i set iDRAC.ActiveDirectory.CertValidationEnable Enabled
That is one extra pair of lines in the same loop — there is a commented-out slot for them in the script below. If you have the CA certificate to hand, there is no reason to ship the weaker setting.
Create the Active Directory groups
In AD, create the groups used above — iDRAC-ReadOnly and iDRAC-Administrator — and add the right people to each. Membership is what grants access from now on; nothing further needs to change on the iDRAC when someone joins or leaves.
Automating Active Directory setup across every server
One iDRAC is a five-minute job. Twenty, thirty or a hundred is not, and running the same fifteen commands by hand that many times is how a typo ends up on one server and stays there for two years. A bash loop fixes both problems.
Step 1. Create the script
[root@rocky-a01 ~]# vi idrac_config_ad.sh
#!/usr/bin/env bash
# Set credentials and domain
USER="root"
PASS='pass'
DOMAIN="domain.local"
# Loop through IPs listed in idrac_list.txt
while read -r ip; do
[[ -z "$ip" ]] && continue
echo "[$ip] configuring AD"
# Configure Global Catalog
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.GCLookupEnable Enabled || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.GCRootDomain "$DOMAIN" || true
# Configure Domain Controllers
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.DCLookupEnable Enabled || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.DCLookupByUserDomain Enabled || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.DCLookupDomainName "$DOMAIN" || true
# Disable certificate validation (for self-signed certs)
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.CertValidationEnable Disabled || true
# ...or, better: upload your CA and leave validation on. Swap the line above for these two.
# racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" sslcertupload -t 2 -f "$CA_CERT" || true
# racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.CertValidationEnable Enabled || true
# Configure user domain
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.UserDomain.1.Name "$DOMAIN" || true
# Map AD groups and privileges
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.1.Domain "$DOMAIN" || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.1.Name iDRAC-ReadOnly || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.1.Privilege 0x1 || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.2.Domain "$DOMAIN" || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.2.Name iDRAC-Administrator || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ADGroup.2.Privilege 0x1ff || true
# Enable AD authentication and set schema
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.Enable Enabled || true
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" set iDRAC.ActiveDirectory.Schema 2 || true
# Verify configuration
racadm --nocertwarn -r "$ip" -u "$USER" -p "$PASS" get iDRAC.ActiveDirectory | egrep 'Enable=|Schema=|GCRootDomain=|DCLookup|GCLookup' || true
echo "+---------------------------------------------------------+"
done < idrac_list.txt
Replace the credentials and the domain with your own. The || true on every line is deliberate: one unreachable iDRAC should not abort the run for the other ninety-nine. The last command in the loop reads the settings back, so the output doubles as the verification pass.
Two improvements worth making before this touches anything real:
# do not keep the password in the file - ask for it once, at the start
read -rp "iDRAC user: " USER
read -rsp "iDRAC password: " PASS; echo
and, if the script lives on disk with credentials in it anyway, at least chmod 600 idrac_config_ad.sh. The password is still visible to ps for the duration of each call — that is a limitation of RACADM's -p, not of the script — so use a dedicated account rather than the one that also opens the racks.
Step 2. Create the list of iDRAC addresses
One address per line:
[root@rocky-a01 ~]# vi idrac_list.txt
192.168.10.11
192.168.10.12
192.168.10.13
192.168.10.14
192.168.10.15
172.16.15.101
172.16.15.102
172.16.15.103
172.16.15.104
172.16.15.105
Step 3. Make the script executable
[root@rocky-a01 ~]# chmod +x idrac_config_ad.sh
Step 4. Run it
Start with a file containing a single address, confirm the result, then put the full list back. Fifteen wrong settings on one server is a fix; on a hundred it is an afternoon.
[root@rocky-a01 ~]# ./idrac_config_ad.sh
[192.168.10.11] configuring AD
[Key=iDRAC.Embedded.1#ActiveDirectory.1]
Object value modified successfully
[Key=iDRAC.Embedded.1#ActiveDirectory.1]
Object value modified successfully
[Key=iDRAC.Embedded.1#UserDomain.1]
Object value modified successfully
[Key=iDRAC.Embedded.1#ADGroup.1]
Object value modified successfully
[Key=iDRAC.Embedded.1#ADGroup.2]
Object value modified successfully
CertValidationEnable=Disabled
DCLookupByUserDomain=Enabled
DCLookupDomainName=domain.local
DCLookupEnable=Enabled
Enable=Enabled
GCLookupEnable=Enabled
GCRootDomain=domain.local
Schema=2
SSOEnable=Disabled
+---------------------------------------------------------+
[192.168.10.12] configuring AD
[Key=iDRAC.Embedded.1#ActiveDirectory.1]
Object value modified successfully
CertValidationEnable=Disabled
DCLookupByUserDomain=Enabled
DCLookupDomainName=domain.local
DCLookupEnable=Enabled
Enable=Enabled
GCLookupEnable=Enabled
GCRootDomain=domain.local
Schema=2
SSOEnable=Disabled
+---------------------------------------------------------+
[root@rocky-a01 ~]#
The Enable=Enabled / Schema=2 block at the end of each host is the verification. If an address produced no such block, that iDRAC was unreachable and || true carried on without it — grep the output for hosts that never printed GCRootDomain= and rerun just those.
Verify with an actual login
Reading the settings back proves they were written, not that anyone can log in. Do the real test once, from the web interface: sign in as [email protected] (or DOMAIN\user) with an account in iDRAC-Administrator, then again with one in iDRAC-ReadOnly and confirm the read-only session really cannot power-cycle anything.
If the login fails, work down this list:
- The iDRAC cannot find a domain controller. Check the DNS servers set on the iDRAC NIC —
racadm get iDRAC.IPv4— and that they answer for your AD zone. - The user is not in a mapped group. Nested groups are not always followed; test with the account directly in the group.
- The user domain does not match.
iDRAC.UserDomain.1.Namemust be the domain users actually authenticate against. - Certificate validation is on and the CA is not uploaded. Either upload it, as above, or you are back to the
Disabledsetting and its trade-off.
Bonus tip
If you are running the script over SSH and it will take a while, start it inside screen so a dropped session does not kill it half way through:
# Start a new screen session
[root@rocky-a01 ~]# screen -S idrac-configure
# You can verify that you are attached to that session
[root@rocky-a01 ~]# screen -ls
There are screens on:
109261.idrac-configure (Attached)
109224.pts-1.rocky-a01 (Detached)
2 Sockets in /run/screen/S-root.
[root@rocky-a01 ~]#
# Now you can run the script. If the session interrupts, the script keeps running.
[root@rocky-a01 ~]# ./idrac_config_ad.sh
Detach with Ctrl+A then D, and reattach later with screen -r idrac-configure.
