Issue Joining Domain

We are having issues joining the domain when imaging.

For the Bare Metal Profile we have setup the following:

Join Computer to: Specify OU

Workgroup/Domain Name: thedomain-name.com

Ogranizatonal Unit to Join: OU=RJD_Computers,OU=RJD,DC=thedomain-name,DC=com

Username: thedomain-name\domainaccountuser

Password: ******************************** :slight_smile:

I belive we have everything setup properly here, we have confirmed that the account info is correct and has proper permissions.

Thoughts?

In my bare metal profiles, I have the username set to just domainaccountuser instead of thedomain-name\domainaccountuser. Domain join works using this format.

Thanks we tried that orginialy and it failed, i will change it back to that… must be some other issue… I am kinda wondering if having the second OU in there is messing it up.

Do you have more than 1 OU defined?

Yup. I have it the same as yours, two OUs. Also, my domain name specifies the FQDN.

I forgot to mention that you’ll have to switch from Wizard to Manual and remove the line: FinishAction=RESTART. This will cause the Wizard to be grayed out and un-editable (this is normal). To edit any settings, you’ll need to go back to Manual and click Undo Changes which will restore the line FinishAction=RESTART. When finished editing, you’ll need to again remove that line.

Thanks for the info, I will update the FinishAction=RESTART and test again.

Do you happen to know why this needs to be removed?

I can’t say this fully explains it but @bradsexton81 specifies this step in his blog: https://www.linkedin.com/pulse/bigfix-osd-fat-images-vs-layered-brad-sexton/. Maybe Brad can explain why this step is required?

@bradsexton81 can you comment?

My suspicion is the need to do that in Custom configuration has probably been overcome by the options in the Profile area of the Image Library, where we specify the Deployment Final Action:

When the OS is installed, after Windows Setup completes there is an automated logon using the built-in Administrator account, which resumes the final steps (RunOnce) from MDT. This is the phase where the BigFix Client is installed, and there’s also a “Recover from Domain” step that runs in case the domain failed to join during Windows Setup…I’m not sure whether this issue still exists, but it was once a problem for me on Static-addressed machines, that during the image deployment, Windows Setup tried to join the domain before setting a static IP address, so my machines would always fail the “during-setup” domain join and would recover at this point.

Once this last step of MDT is complete, we can either reboot, log off, or leave the Administrator session open. Reboot is the default, and is definitely needed if the Domain Join just completed as part of “Recover from Domain”

For @zsmith1101 - My OSD lab is offline at the moment but I should be able to test this scenario next week. Just because several programming languages use the backslash as an escape character, can I ask whether you tried to specify your domain join credential as “DOMAIN\username” with two backslashes? That’s one of the test cases I’d try.

Hi, the join domain step is run before the finish action so it should not interact with the successful or failed result.
Since, by process, the join domain requires a restart to be finalized, the option for “logoff” and “no action” as finish actions are not present in the wizard (and, deleting the entry manually, is like you are setting “no action” as finish action) but the join domain should already be successful or failed at this point.
Logs in C:\Windows\Temp\DeploymentLogs folder could help to understand.
Thanks.

Thanks, I am waiting for further testing to confrim recent changes. The deployment is sucessful it’s just the domain join is not happening, seems to be configured properly but I was not removing the restart entry in the manual section. Waiting to see if this has any effect on it.

i had the restart line removed from the custom settings ini file to allow software and settings load. Once the computer restarts that means the machine is completly rebuilt and those restarts were controled by the bigfix agent. I would revert your changes to your profile and do your domain join without any custom changes to the custom settings ini first.

Thansk for everyone’s help. We are checking the account permissions and making sure it is setup properly.

Log shows it trying 4 times before giving up.

<![LOG[JoinDomain Failure: The account *may* already exist in a different OU. Retrying without the specified OU.]LOG]!><time="10:03:02.000+000" date="11-08-2021" component="ZTIDomainJoin" context="" type="1" thread="" file="ZTIDomainJoin">

Hello.
You can try to manually join the domain on the same computer at the end of the deployment, using the same credentials and OU, to check if everything is ok for the domain credentials and connection.
Thanks.

The account was used in the past for BigFix OSD profiles, oddly enough it works now. I wonder if permissions were the culprit here. I do not have visibility on it that changed but seems to have been cleared up. Thanks everyone!