Technical Tip: How to disable the Winbind service on a secondary node via the API

Description

This article describes the process of disabling the Winbind service on a secondary node using API calls, particularly in cases where the secondary node is not under control and the GUI is not accessible.

Scope

FortiNAC-F.

Solution

1. Enable REST API access for the administrator account via the Admin UI on the active (in-control) node. This setting will be synchronized to the secondary node, even if it is currently not in control:

2. Save the REST API Access Token.

3. Access the secondary node's CLI and run the following commands to verify the status. Alternatively, these API calls can be initiated from the primary node CLI or any external machine capable of running curl requests.

execute enter-shell
curl "https://<Secondary-IP>:8443/api/v2/winbind/config/status" \
  -H "Authorization: Bearer <token>" \
  -k

Example:

fortinac1  # execute enter-shell
fortinac1:~$ curl "https://192.168.10.4:8443/api/v2/winbind/config/status" \
  -H "Authorization: Bearer aypNZyCtirNWkAnkt2XSR34G9T01oH" \
  -k


{
  "status": "success",
  "errorMessage": null,
  "name": null,
  "processEnabled": true,
  "processRunning": true,
  "serviceStatus":"[AD: Stopped]
* winbind.service - Samba Winbind Daemon (Persistent)
 Loaded: loaded (\u001B]8;;file://FortiNAC2/lib/systemd/system/winbind.service\u0007/lib/systemd/system/winbind.service\u001B]8;;\u0007; enabled; vendor preset: disabled)
 Drop-In: /lib/systemd/system/winbind.service.d
 `-\u001B]8;;file://FortiNAC2/lib/systemd/system/winbind.service.d/winbind.service.conf\u0007winbind.service.conf\u001B]8;;\u0007
 Active: activating (auto-restart) (Result: exit-code) since Fri 2026-06-05 09:44:44 UTC; 1234s ago
 Docs: \u001B]8;;man:winbindd(8)\u0007man:winbindd(8)\u001B]8;;\u0007
 \u001B]8;;man:samba(7)\u0007man:samba(7)\u001B]8;;\u0007
 \u001B]8;;man:smb.conf(5)\u0007man:smb.conf(5)\u001B]8;;\u0007
 Process: 1234 ExecStart=/usr/sbin/winbindd --foreground --no-process-group $WINBINDOPTIONS \u001B[0;1;31m(code=exited, status=1/FAILURE)\u001B[0m
 Main PID: 1234 (code=exited, status=1/FAILURE)
 Status: \"Starting process...\"
"}fortinac1:~$

4. Disable the Winbind Service.
   Execute the following API request to disable the Winbind service.

curl -X POST "https://<Secondary-IP>:8443/api/v2/winbind/config/disable" \
  -H "Authorization: Bearer <Authorization_Token>" \
  -k

Example:

fortinac1:~$ curl -X POST "https://192.168.10.4:8443/api/v2/winbind/config/disable" \
  -H "Authorization: Bearer aypNZyCtirNWkAnkt2XSR34G9T01oH" \
  -k

Response:
{
  "status": "success",
  "errorMessage": null,
  "name": null,
  "processEnabled": true,
  "processRunning": true,
  "serviceStatus":"[AD: Stopped]
* winbind.service - Samba Winbind Daemon (Persistent)
 Loaded: loaded (\u001B]8;;file://FortiNAC2/lib/systemd/system/winbind.service\u0007/lib/systemd/system/winbind.service\u001B]8;;\u0007; enabled; vendor preset: disabled)
 Drop-In: /lib/systemd/system/winbind.service.d
 `-\u001B]8;;file://FortiNAC2/lib/systemd/system/winbind.service.d/winbind.service.conf\u0007winbind.service.conf\u001B]8;;\u0007
 Active: inactive (dead) 
 (Result: exit-code) Docs: \u001B]8;;man:winbindd(8)\u0007man:winbindd(8)\u001B]8;;\u0007
 \u001B]8;;man:samba(7)\u0007man:samba(7)\u001B]8;;\u0007
 \u001B]8;;man:smb.conf(5)\u0007man:smb.conf(5)\u001B]8;;\u0007
 Process: 1234 ExecStart=/usr/sbin/winbindd --foreground --no-process-group $WINBINDOPTIONS \u001B[0;1;31m(code=exited, status=1/FAILURE)\u001B[0m
 Main PID: 1234 (code=exited, status=1/FAILURE)

Jun05 09:44:44 fortinac1 systemd[l]: Stopped Samba Winbind Daemon (Persistent) . 
"} fortinac1:~$ 

5. Enable the Winbind Service.
   Execute the following API request to enable the Winbind service.

curl -X POST "https://<Secondary-IP>:8443/api/v2/winbind/config/enable" \
  -H "Authorization: Bearer <token>" \
  -k

Example:

fortinac1:~$ curl -X POST "https://192.168.10.4:8443/api/v2/winbind/config/enable" \
  -H "Authorization: Bearer aypNZyCtirNWkAnkt2XSR34G9T01oH" \
  -k

Response:
{
  "status": "success",
  "errorMessage": null,
  "name": null,
  "processEnabled": true,
  "processRunning": true,
  "serviceStatus": "[AD: Running]
* winbind.service - Samba Winbind Daemon (Persistent)
 Loaded: loaded (file://FortiNAC2/lib/systemd/system/winbind.service; enabled; vendor preset: disabled)
 Drop-In: /lib/systemd/system/winbind.service.d
 `- winbind.service.conf
 Active: active (running) since Fri 2026-06-05 09:44:44 UTC; 44min ago
 Docs: man:winbindd(8) man:samba(7) man:smb.conf(5)
 Main PID: 5678 (winbindd)
 Status: \"winbindd: ready to serve connections...\"
 Tasks: 5
 Memory: 12.3M
 CGroup: /system.slice/winbind.service
         `-5678 /usr/sbin/winbindd --foreground --no-process-group
"
}

After executing the API calls, the following results are expected:

• An HTTP 401 Unauthorized response if the authentication token is invalid or missing:

Response example:

<!doctype html>
<html lang="en">
<head>
  <title>HTTP Status 401 – Unauthorized</title>
  <style type="text/css">
    body {font-family:Tahoma,Arial,sans-serif;}
    h1, h2, h3, b {color:white;background-color:#525D76;}
    h1 {font-size:22px;}
    h2 {font-size:16px;}
    h3 {font-size:14px;}
    p {font-size:12px;}
    a {color:black;}
    .line {height:1px;background-color:#525D76;border:none;}
  </style>
</head>
<body>
  <h1>HTTP Status 401 – Unauthorized</h1>
</body>
</html>

Solution for HTTP 401 Unauthorized error:
Ensure that the Allow REST API Access option is enabled for the administrator account and that the correct API allowed subnets are defined.

• An HTTP 403 Forbidden response will be seen if the user does not have sufficient permissions.

Response example:

HTTP Status 403 – Forbidden

Solution for the HTTP 403 Forbidden error:
Verify user permissions, REST API access settings, and allowed subnet configuration for the admin account.

Related document:
Post /winbind/config/disable