I want to use my Windows AD credentials to login the Ubuntu 16.04 machine. I use PBIS (PowerBroker Identity Services) AD-bridge from Beyondtrust version 8.5.2.265. Windows version is Windows Server 2012 R2. These errors pop up in /var/log/auth.log:Jan 16 08:34:51 [HOSTNAME] lightdm: PAM adding faulty module: pam_kwallet5.soJan 16 08:34:59 [HOSTNAME] lightdm: pam_succeed_if(lightdm:auth): requirement user ingroup nopasswdlogin not met by user Administrator@winsrv.localJan 16 08:35:01 [HOSTNAME] CRON[12249]: pam_unix(cron:session): session opened for user root by (uid=0)Jan 16 08:35:01 [HOSTNAME] CRON[12249]: pam_unix(cron:session): session closed for user rootJan 16 08:35:03 [HOSTNAME] lightdm: [lsass-pam] [module:pam_lsass]User Administrator@winsrv.local is denied access because they are not in the 'require membership of' listJan 16 08:35:03 [HOSTNAME] lightdm: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:Administrator@winsrv.local][error code:40158]Jan 16 08:35:07 [HOSTNAME] systemd-logind[1050]: Removed session c2.I have changed the configuration option RequireMembershipOf to match the security group domain^users which I copied from /opt/pbis/bin/enum-groups The options from /opt/pbis/bin/config --dump:AllowDeleteTo AllowReadTo AllowWriteTo MaxDiskUsage 104857600MaxEventLifespan 90MaxNumEvents 100000DomainSeparator \\SpaceReplacement ^EnableEventlog falseSaslMaxBufSize 16777215Providers ActiveDirectoryDisplayMotd falsePAMLogLevel errorUserNotAllowedError Access deniedAssumeDefaultDomain trueCreateHomeDir trueCreateK5Login trueSyncSystemTime trueTrimUserMembership trueLdapSignAndSeal falseLogADNetworkConnectionEvents trueNssEnumerationEnabled trueNssGroupMembersQueryCacheOnly trueNssUserMembershipQueryCacheOnly falseRefreshUserCredentials trueCacheEntryExpiry 14400DomainManagerCheckDomainOnlineInterval 300DomainManagerUnknownDomainCacheTimeout 3600MachinePasswordLifespan 2592000MemoryCacheSizeCap 0HomeDirPrefix /homeHomeDirTemplate %H/%URemoteHomeDirTemplate HomeDirUmask 022LoginShellTemplate /bin/bashSkeletonDirs /etc/skelUserDomainPrefix winsrv.localDomainManagerIgnoreAllTrusts falseDomainManagerIncludeTrustsListDomainManagerExcludeTrustsListRequireMembershipOf domain^usersLocal_AcceptNTLMv1 trueLocal_HomeDirTemplate %H/local/%D/%ULocal_HomeDirUmask 022Local_LoginShellTemplate /bin/shLocal_SkeletonDirs /etc/skelUserMonitorCheckInterval 1800LsassAutostart trueEventlogAutostart trueBlacklistDC/etc/pam.d/common-session file:# here are the per-package modules (the Primary block)session [default=1]                     pam_permit.so# here's the fallback if no module succeedssession requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundsession required                        pam_permit.so# The pam_umask module will set the umask according to the system default in# /etc/login.defs and user settings, solving the problem of different# umask settings with different shells, display managers, remote sessions etc.# See man pam_umask.session optional                        pam_umask.so# and here are more per-package modules (the Additional block)session optional        pam_lsass.sosession required        pam_unix.sosession optional        pam_systemd.sosession optional        pam_ecryptfs.so unwrap# end of pam-auth-update config/etc/pam.d/common-auth file:# here are the per-package modules (the Primary block)auth    [success=2 default=ignore]      pam_lsass.soauth    [success=1 default=ignore]      pam_unix.so nullok_secure# here's the fallback if no module succeedsauth    requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundauth    required                        pam_permit.so# and here are more per-package modules (the Additional block)auth    optional        pam_ecryptfs.so unwrap# end of pam-auth-update config/etc/pam.d/common-account file:# here are the per-package modules (the Primary block)account [success=ok new_authtok_reqd=ok default=ignore]         pam_lsass.so unknown_okaccount [success=2 new_authtok_reqd=done default=ignore]        pam_lsass.soaccount [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so# here's the fallback if no module succeedsaccount requisite                       pam_deny.so# prime the stack with a positive return value if there isn't one already;# this avoids us returning an error just because nothing sets a success code# since the modules above will each just jump aroundaccount required                        pam_permit.so# and here are more per-package modules (the Additional block)# end of pam-auth-update config
PBIS auth.log requirement user ingroup nopasswdlogin not met by user Administrator@domain.local
authentication;pam;active directory