Applies To: Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2
This guide explains the steps that you complete to perform an
offline domain join. During an offline domain join, a computer is
configured to join a domain without contacting a domain controller. This
guide includes the following sections:
Offline domain join is a new process that computers that run
Windows® 7 or Windows Server® 2008 R2 can use to join a domain without
contacting a domain controller. This makes it possible to join computers
to a domain in locations where there is no connectivity to a corporate
network.
For example, an organization might need to deploy many
virtual machines in a datacenter. Offline domain join makes it possible
for the virtual machines to be joined to the domain when they initially
start after the installation of the operating system. No additional
restart is required to complete the domain join. This can significantly
reduce the overall time that is required for wide-scale virtual-machine
deployments.
A domain join establishes a trust relationship between a
computer running a Windows operating system and an Active Directory®
domain. This operation requires state changes to Active Directory Domain
Services (AD DS) and state changes on the computer that is joining the
domain. To complete a domain join in the past using previous Windows®
operating systems, the computer that joined the domain had to be running
and it had to have network connectivity to contact a domain controller.
Offline domain join provides the following advantages over the previous
requirements:
-
The Active Directory state changes are completed without any network traffic to the computer.
-
The computer state changes are completed without any network traffic to a domain controller.
-
Each set of changes can be completed at a different time.
The following sections explain some of the benefits that offline domain join can provide.
Offline domain join can reduce the total cost of ownership
for computers by reducing the startup time that is required for each
server and by increasing the reliability of domain join operations in
production environments.
Data centers commonly have a provisioning server that
configures an image and then sends that image to be deployed on a
production computer. The production computer is set up, joined to the
domain, and restarted. If there are any problems associated with the
domain join, such as network connectivity problems or problems that are
associated with necessary servers that are offline, the problems have to
be diagnosed and resolved at that time. In this situation, an offline
domain join helps prevent problems that can arise with the communication
between the production computer and a domain controller by configuring
the domain join information during the setup for the production
computer. The total amount of time to set up each server is reduced by
eliminating the additional restart that is required to complete an
online domain join.
In Windows Server 2008, there is a mechanism to perform
domain join operations against a read-only domain controller (RODC).
However, to perform a domain join operation an RODC you have to complete
the following multiple steps:
-
Precreate the computer account in the directory, and set some additional attributes using scripts.
-
If necessary, modify the Password Replication Policy (PRP) of
the RODC to allow the password for the computer that you want to join to
the domain to be cached by the RODC.
-
Force replication of the secrets of the computer that is to join to the domain.
-
Communicate the password offline to the computer that is about to join to the domain.
-
Run a custom script that targets the RODC to complete the join.
When you use offline domain join, the steps for performing domain join operations against an RODC are simplified, as follows:
-
Precreate the account in AD DS.
-
Force replication of the secrets of the computer that is to join to the domain.
-
Send the relevant state information that the domain-joining computer needs to consume to a text file.
-
The computer consumes the information in the text file; then, when it starts it is joined to the domain.
By using deployment tools, such as Windows System Image
Manager, you can perform an unattended domain join during an operating
system installation by providing information that is relevant to the
domain join in an Unattend.xml file. Using the same Unattend.xml file,
you can supply the information that is necessary for the computers that
run Windows 7 and Windows Server 2008 R2 to perform offline domain join.
The Unattend.xml file for Windows 7 and Windows Server 2008 R2 includes a new section to support offline domain join.
To perform an offline domain join, you run commands by using a
new tool named Djoin.exe. You use Djoin.exe to provision computer
account data into AD DS. You also use it to insert the computer account
data into the Windows directory of the destination computer, which is
the computer that you want to join to the domain. The following sections
explain operating system requirements and credential requirements for
performing an offline domain join.
The offline domain join does not have to be completed within a
specific time period. The computer account that is provisioned remains
in AD DS unless an administrator intervenes. However, many organizations
run scripts every 30 to 60 days to clean up stale or unused computer
accounts.
You can run Djoin.exe only on computers that run Windows 7
or Windows Server 2008 R2. The computer on which you run Djoin.exe to
provision computer account data into AD DS must be running Windows 7 or
Windows Server 2008 R2. The computer that you want to join to the domain
must also be running Windows 7 or Windows Server 2008 R2.
By default, the Djoin.exe commands target a domain
controller that runs Windows Server 2008 R2. However, you can specify an
optional /downlevel parameter if you want to target a
domain controller that is running a version of Windows Server that is
earlier than Windows Server 2008 R2.
To perform an offline domain join, you must have the rights
that are necessary to join workstations to the domain. Members of the
Domain Admins group have these rights by default. If you are not a
member of the Domain Admins group, a member of the Domain Admins group
must complete one of the following actions to enable you to join
workstations to the domain:
-
Use Group Policy to grant you the required user rights. This
method allows you to create computers in the default Computers container
and in any organizational unit (OU) that is created later (if no Deny
access control entries (ACEs) are added).
-
Edit the access control list (ACL) of the default Computers
container for the domain to delegate the correct permissions to you.
-
Create an OU and edit the ACL on that OU to grant you the Create child – Allow permission. Pass the /machineOU parameter to the djoin /provision command.
The following procedures show how to grant the user rights with Group Policy and how to delegate the correct permissions.
You can use the Group Policy Management Console (GPMC) to
modify the domain policy or create a new policy that has settings that
grant the user rights to add workstations to a domain.
Membership in
Domain Admins, or
equivalent, is the minimum required to grant user rights. Review details
about using the appropriate accounts and group memberships at
Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).
-
Click Start, click Administrative Tools, and then click Group Policy Management.
-
Double-click the name of the forest, double-click Domains, double-click the name of the domain in which you want to join a computer, right-click Default Domain Policy, and then click Edit.
-
In the console tree, double-click Computer Configuration, double-click Policies, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then double-click User Rights Assignment.
-
In the details pane, double-click Add workstations to domain.
-
Select the Define these policy settings check box, and then click Add User or Group.
-
Type the name of the account that you want to grant the user rights to, and then click OK twice.
You can use a tool such as Ldp.exe to delegate
permissions to join workstations to a domain. As a best practice, you
should delegate permissions to a group, and then add users to the group
or remove them as needed.
Membership in
Domain Admins, or
equivalent, is the minimum required to delegate permissions. Review
details about using the appropriate accounts and group memberships at
Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).
-
Click Start, click Run, type ldp, and then click OK.
-
Click Connection, click Connect, and in Server type the name of a domain controller. If you are logged on to a domain controller, you can type localhost. When you are done, click OK.
-
Click Connection, and then click Bind. If you are logged on as a member of the Domain Admins group, click Bind as currently logged on user. If you are logged on as a different user, click Bind with credentials, and then type the name, password, and domain of an account that is a member of the Domain Admins group. Click OK.
-
Click View, click Tree, select DC=, and then click OK.
-
In the console tree, double-click DC=, right-click CN=Computers,DC=, click Advanced, click Security Descriptor, and then click OK.
-
Click ACE, click Add ACE, type the name of the account that you want to be able to join workstations to the domain, select the Create child check box, and then select the Inherit check box. In Object type, select computer – class (you might have to type computer to select computer – class), click OK, and then click Update.
Run Djoin.exe at an elevated command prompt to provision the
computer account metadata. When you run the provisioning command, the
computer account metadata is created in a .txt file that you specify as
part of the command. After you run the provisioning command, you can
either run Djoin.exe again to request the computer account metadata and
insert it into the Windows directory of the destination computer or you
can save the computer account metadata in an Unattend.xml file and then
specify the Unattend.xml file during an unattended operating system
installation of the destination computer.
For more information about the NetProvisionComputerAccount
function that is used to provision the computer account during an
offline domain join, see
NetProvisionComputerAccount Function
(http://go.microsoft.com/fwlink/?LinkId=162426). For more information
about the NetRequestOfflineDomainJoin function that runs locally on the
destination computer, see
NetRequestOfflineDomainJoin Function (http://go.microsoft.com/fwlink/?LinkId=162427).
This section describes the syntax for Djoin.exe.
djoin /provision /domain /machine /savefile [/machineou ] [/dcname ] [/reuse] [/downlevel] [/defpwd] [/nosearch] [/printblob] [/rootcacerts] [/certtemplate ] [/policynames ] [/policypaths ]
djoin /requestodj /loadfile /windowspath /localos
 Note |
|
The /rootcacerts, /certtemplate, /policynames, and /policypaths
parameters are valid only on Windows Server 2012. They allow
administrators to provide mobile users who never connect to corporate
networks (physically or through VPN) with the ability to join a computer
to the domain and configure it with DirectAccess policies. |
Parameter
|
Description
|
/provision
|
Creates a computer account in AD DS.
|
/domain
|
Specifies the name of the domain to join.
|
/machine
|
Specifies the name of the computer that you want to join to the domain.
|
/machineou
|
Specifies the name of the organizational unit (OU) in
which you want the computer account to be created. By default, the
computer account is created in the Computers container. This parameter
is ignored if /reuse is specified.
|
/dcname
|
Specifies the name of a specific domain controller
that will create the computer account. If you do not specify a domain
controller, the domain controller Locator (DC Locator) process is used
to select a domain controller.
|
/reuse
|
Specifies the reuse of any existing computer account. The password for the computer account will be reset.
|
/downlevel
|
Supports the use of a domain controller that runs a version of Windows Server that is earlier than Windows Server 2008 R2.
|
/savefile
|
Saves provisioning data to a file.
|
/defpwd
|
Uses the default machine account password (not recommended).
|
/nosearch
|
Skips account conflict detention. Requires the /DCName parameter.
|
/printblob
|
Return a base64-encoded metadata blob for an answer file.
|
/rootcacerts
This parameter is only available on Windows Server 2012.
|
Optionally include root Certificate Authority certificates.
|
/certtemplate
This parameter is only available on Windows Server 2012.
|
Optional of machine certificate template. Includes root Certificate Authority certificates.
|
/policynames
This parameter is only available on Windows Server 2012.
|
Optional semicolon-separated list of Group Policy object (GPO) names. Each name is the displayName of the GPO in AD DS.
|
/policypaths
This parameter is only available on Windows Server 2012.
|
Optional semicolon-separated list of policy paths. Each path is a path to a registry.pol file.
GPOs store registry-based configuration settings in
registry.pol files. To include registry-based configuration settings in
the blob data, specify the path and file name using any of the following
formats:
-
/POLICYPATHS mypolicy.xyz
-
/POLICYPATHS .\mypolicy2.xyz
-
/POLICYPATHS c:\tmp\mypolicy3.xyz
-
/POLICYPATHS \\server\share\mypolicy4.xyz
-
/POLICYPATHS mypolicy.xyz;.\mypolicy2.xyz;c:\tmp\mypolicy3.xyz;\\server\share\mypolicy4.xyz
For more information about registry.pol files, see Registry.pol.
|
/NetBIOS
Applies to computers that run versions of Windows beginning with Windows Server 2012 R2 and Windows 8.1.
|
Optional NetBIOS name of the computer joining the domain.
|
/psite
Applies to computers that run versions of Windows beginning with Windows Server 2012 R2 and Windows 8.1.
|
Optional name of the persistent site to put the computer joining the domain in.
|
/dsite
Applies to computers that run versions of Windows beginning with Windows Server 2012 R2 and Windows 8.1.
|
Optional name of the dynamic site to initially put the computer joining the domain in.
|
/primarydns
Applies to computers that run versions of Windows beginning with Windows Server 2012 R2 and Windows 8.1.
|
Optional name of primary DNS domain of the computer joining the domain.
|
/requestodj
|
Requests an offline domain join at the next start.
|
/Loadfile
|
Specifies the output from a previous provisioning command.
|
/windowspath
|
Specifies the path to the Windows directory of the offline image. If you are using the /localos parameter, specify %systemroot% or %windir% as the value of the /windowspath parameter.
|
/localos
|
Targets the local operating system installation,
instead of an offline image, with the domain join information. If you
use this parameter, the value that you specify for /windowspath should be %systemroot% or %windir%.
Run this parameter only on a destination computer that you want to join
to the domain. This parameter is blocked from being run on a domain
controller. Because this parameter injects the blob data into the
locally running operating system image, you must restart the computer to
complete the domain join operation, as you must also do for an online
domain join.
|
The offline domain join process includes the following steps:
-
Run the djoin.exe /provision command to create
computer account metadata for the destination computer (the computer
that you want to join to the domain). As part of this command, you must
specify the name of the domain that you want the computer to join.
-
Run the djoin.exe /requestODJ command to insert the computer account metadata into the Windows directory of the destination computer.
-
When you start the destination computer, either as a virtual
machine or after a complete operating system installation, the computer
will be joined to the domain that you specify.
The following sections explain different ways for you to
perform these steps. You can use the Windows Server 2008 Hyper-V™
virtualization feature to create virtual machines, you can use different
physical computers, or you can run an unattended setup to perform an
operating system installation on the destination computer. In any of
these cases, the computer where you run the provisioning command and the
computer where you run the request command must be running Windows 7 or
Windows Server 2008 R2.
You can also perform these steps using a dual-boot computer.
In this case, follow the steps to perform an offline domain join using
Hyper-V, but substitute the virtual machines with physical partitions
that are running Windows 7 or Windows Server 2008 R2.
To perform an offline domain join using Hyper-V, create the following virtual machines:
-
VM1: A domain controller that runs Windows Server 2008 R2.
-
VM2: A domain-joined computer that runs Windows 7 or Windows
Server 2008 R2. This computer will serve as a provisioning server on
which you can run the djoin /provision command. As an alternative, you can complete these steps without using this virtual machine by running the djoin /provision
command on the domain controller that is VM1. This additional VM2 is
shown to provide a more realistic example of how computers are
provisioned in production environments, where a domain-joined computer
is used typically as a provisioning server.
-
VM3: A computer that runs Windows 7 or Windows Server 2008 R2 that you want to join to the domain.
|
Note |
|
Do not use differencing disks from the same parent virtual hard
disk (VHD) for these virtual machines. The differencing disk will not
start correctly after you complete the steps to perform the offline
domain join. You should also not use copies of the same VHD, because it
will cause one virtual machine to be disabled when you try to mount it
from the other virtual machine. |
Complete the following steps to perform the offline domain join:
-
Log on to VM2 as a user who has rights to add workstations to a domain.
-
Type the following command to provision the destination computer:
djoin /provision /domain /machine /savefile
 Security Note |
|---|
|
The base64-encoded metadata blob that is created by the
provisioning command contains very sensitive data. It should be treated
just as securely as a plaintext password. The blob contains the machine
account password and other information about the domain, including the
domain name, the name of a domain controller, the security ID (SID) of
the domain, and so on. If the blob is being transported physically or
over the network, care must be taken to transport it securely. |
-
Shut down VM3 and VM2, and then mount VM3 from VM2.
To do this in Hyper-V, right-click VM2, and then click Settings. Click IDE Controller, and then click Add. Select Virtual hard disk (.vhd) file, click Browse, navigate to the location of the .vhd file for VM3, click Open, and then click OK.
-
Restart VM2, and then use Windows Explorer to locate the drive
where VM3 is mounted. At an elevated command prompt, type the following
command to request the offline domain join data:
djoin /requestODJ /loadfile /windowspath
-
Shut down VM2, and then unmount VM3 from VM2. To do this in Hyper-V, right-click VM2, and then click Settings. Click the integrated device electronics (IDE) controller that corresponds to VM3, and then click Remove.
-
Start VM3. The computer will be joined to the domain after it starts.
If you experience any problems running the Djoin.exe
commands, you can view the log file on VM2 at
%windir%\debug\netsetup.log for more information.
To perform an offline domain join using physical computers,
you can complete the following steps. The best practice in this case is
to have one domain controller, one domain-joined computer to use as a
provisioning server, and one client computer that you want to join to
the domain.
-
On the provisioning server, open an elevated command prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
-
Type the following command to provision the computer account:
djoin /provision /domain /machine /savefile blob.txt
-
Copy the blob.txt file to the client computer.
-
On the client computer, open an elevated command prompt, and
then type the following command to request the domain join:
djoin /requestODJ /loadfile blob.txt /windowspath %SystemRoot% /localos
 Caution |
|---|
|
You cannot run this command with the /localos parameter on a domain controller. |
-
Reboot the client computer. The computer will be joined to the domain.
To perform an offline domain join during an operating
system installation, you must first run Djoin.exe to provision the
computer account metadata. Then, you create an Unattend.xml file and
include a new section in it for the offline domain join data. In the new
section, you can insert the computer account metadata.
The component name for the new section is
Microsoft-Windows-UnattendJoin/Identification/Provisioning, and it
includes the following structure:
You have to insert the computer account metadata within the
and tags. After you create the
Unattend.xml file, start the computer that you want to join to the
domain in Safe Mode or start the computer in Windows Preinstallation
Environment (Windows PE), and then run the
setup command with an answer file, as shown in the following example:
See Also
Although you can safely delete any thumbs.db file,
Windows will automatically recreate it unless the option to create
thumbs.db files is disabled. The following sections detail how to stop
thumb.db files from being generated in different versions of Windows. Select your version from the menu below and follow the steps.
