Join Domain

Joins the computer to an Active Directory domain. If a computer object with the same name already exists, the computer joins it in the OU where it already is, or the object can be deleted first so the computer is created in the chosen OU.

Parameters

Domain User Name

Required

Domain account with permission to join the computer to domain. Ex. CONTOSO\Administrator

Password

Required

Password for the domain account.

Domain Name

Required

Fully qualified domain name to join. Ex. contoso.local

Preferred Domain Controller

Required

Preferred domain controller FQDN used for the domain join. Ex. dc01.contoso.local

OU Path

Optional

The OU in Active Directory where the computer is placed when it joins the domain.\nExample: OU=Computers,OU=Copenhagen,DC=contoso,DC=local\n\nLeave empty to use the domain’s default location for new computers, normally the Computers container.\n\nIf a computer object with the same name already exists in Active Directory, the computer joins that object in the OU where it already is, and this field is not used. The step log shows where the object was found and where the computer ended up. To place the computer in this OU anyway, enable Delete Computer Object below, or move the object in Active Directory first.\n\nTip - one OU per device: an OU typed in here is used for every device the workflow runs on. To pick the OU from the device name, add an Execute PowerShell Snippet brick earlier in the same workflow, let it work out the OU, store the result in a global variable, and write that variable in this field instead of a fixed OU.\n\nExample - names starting with CPH- go to Copenhagen, AAR- to Aarhus, all others to a default OU:\n$global:JoinOU = switch -Wildcard ($env:COMPUTERNAME) { ‘CPH-’ { ‘OU=Copenhagen,DC=contoso,DC=local’ } ‘AAR-’ { ‘OU=Aarhus,DC=contoso,DC=local’ } default { ‘OU=Computers,DC=contoso,DC=local’ } }\n\nThis field is then filled in with $global:JoinOU. If a Rename Computer brick runs earlier in the same workflow, the new name only takes effect after a restart: use the variable that holds the new name in the snippet instead of $env:COMPUTERNAME.

Allow Reboot

Optional — Default: True

Enable to reboot the workstation after successful domain join. Disable to continue without rebooting.

Allow Rejoin Domain

Optional — Default: False

Enable to unjoin the computer from the current domain before joining the target domain. Disable to skip the unjoin step; a computer that is already a member of the target domain is then left as it is.\n\nThe computer’s existing object in Active Directory is reused in the OU where it is, unless Delete Computer Object is enabled.

Delete Computer Object

Optional — Default: False

Enable to delete an existing computer object with the same name in Active Directory before the computer joins, so a new object is created in the OU chosen above. Disable to reuse an existing object in the OU where it already is.\n\nWarning: deleting the object also deletes the BitLocker recovery keys and the local administrator password (LAPS) stored on it, and the computer’s group memberships. If another, active computer has the same name, its object is deleted and that computer loses its connection to the domain - make sure names are unique before enabling this.\n\nThe domain account must be allowed to delete computer objects in the OU where the object is. If it is not, the step fails before joining and nothing is changed in Active Directory.

Ping DC Retry Later

Optional — Default: False

Enable to ping the preferred domain controller before join and return retry later when unreachable. Disable to skip the connectivity pre-check.

Details

• Category: Provisioning
• Brick ID: AD-JoinDomain