Offline domain join can reduce the total cost of ownership for computers by reducing the startup time that is required for each server and by increasing the reliability of domain join operations in production environments.

Data centers commonly have a provisioning server that configures an image and then sends that image to be deployed on a production computer. The production computer is set up, joined to the domain, and restarted. If there are any problems associated with the domain join, such as network connectivity problems or problems that are associated with necessary servers that are offline, the problems have to be diagnosed and resolved at that time. In this situation, an offline domain join helps prevent problems that can arise with the communication between the production computer and a domain controller by configuring the domain join information during the setup for the production computer. The total amount of time to set up each server is reduced by eliminating the additional restart that is required to complete an online domain join.

In Windows Server 2008, there is a mechanism to perform domain join operations against a read-only domain controller (RODC). However, to perform a domain join operation an RODC you have to complete the following multiple steps:

1. Precreate the computer account in the directory, and set some additional attributes using scripts.
   
   
2. If necessary, modify the Password Replication Policy (PRP) of the RODC to allow the password for the computer that you want to join to the domain to be cached by the RODC.
   
   
3. Force replication of the secrets of the computer that is to join to the domain.
   
   
4. Communicate the password offline to the computer that is about to join to the domain.
   
   
5. Run a custom script that targets the RODC to complete the join.
   
   

When you use offline domain join, the steps for performing domain join operations against an RODC are simplified, as follows:

1. Precreate the account in AD DS.
   
   
2. Force replication of the secrets of the computer that is to join to the domain.
   
   
3. Send the relevant state information that the domain-joining computer needs to consume to a text file.
   
   
4. The computer consumes the information in the text file; then, when it starts it is joined to the domain.
   
   

By using deployment tools, such as Windows System Image Manager, you can perform an unattended domain join during an operating system installation by providing information that is relevant to the domain join in an Unattend.xml file. Using the same Unattend.xml file, you can supply the information that is necessary for the computers that run Windows 7 and Windows Server 2008 R2 to perform offline domain join.

The Unattend.xml file for Windows 7 and Windows Server 2008 R2 includes a new section to support offline domain join.

You can run Djoin.exe only on computers that run Windows 7 or Windows Server 2008 R2. The computer on which you run Djoin.exe to provision computer account data into AD DS must be running Windows 7 or Windows Server 2008 R2. The computer that you want to join to the domain must also be running Windows 7 or Windows Server 2008 R2.

By default, the Djoin.exe commands target a domain controller that runs Windows Server 2008 R2. However, you can specify an optional /downlevel parameter if you want to target a domain controller that is running a version of Windows Server that is earlier than Windows Server 2008 R2.

To perform an offline domain join, you must have the rights that are necessary to join workstations to the domain. Members of the Domain Admins group have these rights by default. If you are not a member of the Domain Admins group, a member of the Domain Admins group must complete one of the following actions to enable you to join workstations to the domain:

• Use Group Policy to grant you the required user rights. This method allows you to create computers in the default Computers container and in any organizational unit (OU) that is created later (if no Deny access control entries (ACEs) are added).
  
  
• Edit the access control list (ACL) of the default Computers container for the domain to delegate the correct permissions to you.
  
  
• Create an OU and edit the ACL on that OU to grant you the Create child – Allow permission. Pass the /machineOU parameter to the djoin /provision command.
  
  

The following procedures show how to grant the user rights with Group Policy and how to delegate the correct permissions.

 Granting user rights to join workstations to the domain

You can use the Group Policy Management Console (GPMC) to modify the domain policy or create a new policy that has settings that grant the user rights to add workstations to a domain.

Membership in Domain Admins, or equivalent, is the minimum required to grant user rights. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

 To grant rights to join workstations to a domain

1. Click Start, click Administrative Tools, and then click Group Policy Management.

2. Double-click the name of the forest, double-click Domains, double-click the name of the domain in which you want to join a computer, right-click Default Domain Policy, and then click Edit.

3. In the console tree, double-click Computer Configuration, double-click Policies, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then double-click User Rights Assignment.

4. In the details pane, double-click Add workstations to domain.

5. Select the Define these policy settings check box, and then click Add User or Group.

6. Type the name of the account that you want to grant the user rights to, and then click OK twice.

 Delegating permissions to join workstations to the domain

You can use a tool such as Ldp.exe to delegate permissions to join workstations to a domain. As a best practice, you should delegate permissions to a group, and then add users to the group or remove them as needed.

Membership in Domain Admins, or equivalent, is the minimum required to delegate permissions. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

 To delegate permissions to join workstations to a domain

1. Click Start, click Run, type ldp, and then click OK.

2. Click Connection, click Connect, and in Server type the name of a domain controller. If you are logged on to a domain controller, you can type localhost. When you are done, click OK.

3. Click Connection, and then click Bind. If you are logged on as a member of the Domain Admins group, click Bind as currently logged on user. If you are logged on as a different user, click Bind with credentials, and then type the name, password, and domain of an account that is a member of the Domain Admins group. Click OK.

4. Click View, click Tree, select DC=<domain>, and then click OK.

5. In the console tree, double-click DC=<domain>, right-click CN=Computers,DC=<domain>, click Advanced, click Security Descriptor, and then click OK.

6. Click ACE, click Add ACE, type the name of the account that you want to be able to join workstations to the domain, select the Create child check box, and then select the Inherit check box. In Object type, select computer – class (you might have to type computer to select computer – class), click OK, and then click Update.

This section describes the syntax for Djoin.exe.

djoin /provision /domain <domain_name> /machine <destination computer> /savefile <filename.txt> [/machineou <OU name>] [/dcname <name of domain controller>] [/reuse] [/downlevel] [/defpwd] [/nosearch] [/printblob] [/rootcacerts] [/certtemplate <name>] [/policynames <name(s)>] [/policypaths <Path(s)>]

djoin /requestodj /loadfile <filename.txt> /windowspath <path to the Windows directory of the offline image> /localos

Note
The /rootcacerts, /certtemplate, /policynames, and /policypaths parameters are valid only on Windows Server “8” Beta. They allow administrators to provide mobile users who never connect to corporate networks (physically or through VPN) with the ability to join a computer to the domain and configure it with DirectAccess policies.

To perform an offline domain join using Hyper-V, create the following virtual machines:

• VM1: A domain controller that runs Windows Server 2008 R2.
  
  
• VM2: A domain-joined computer that runs Windows 7 or Windows Server 2008 R2. This computer will serve as a provisioning server on which you can run the djoin /provision command. As an alternative, you can complete these steps without using this virtual machine by running the djoin /provision command on the domain controller that is VM1. This additional VM2 is shown to provide a more realistic example of how computers are provisioned in production environments, where a domain-joined computer is used typically as a provisioning server.
  
  
• VM3: A computer that runs Windows 7 or Windows Server 2008 R2 that you want to join to the domain.
  
  

Note
Do not use differencing disks from the same parent virtual hard disk (VHD) for these virtual machines. The differencing disk will not start correctly after you complete the steps to perform the offline domain join. You should also not use copies of the same VHD, because it will cause one virtual machine to be disabled when you try to mount it from the other virtual machine.

Complete the following steps to perform the offline domain join:

1. Log on to VM2 as a user who has rights to add workstations to a domain.
   
   
2. Type the following command to provision the destination computer:
   
   
   djoin /provision /domain <domain to be joined> /machine <name of the destination computer> /savefile <filename.txt>

   Security Note

   The base64-encoded metadata blob that is created by the provisioning command contains very sensitive data. It should be treated just as securely as a plaintext password. The blob contains the machine account password and other information about the domain, including the domain name, the name of a domain controller, the security ID (SID) of the domain, and so on. If the blob is being transported physically or over the network, care must be taken to transport it securely.

3. Shut down VM3 and VM2, and then mount VM3 from VM2.
   
   To do this in Hyper-V, right-click VM2, and then click Settings. Click IDE Controller, and then click Add. Select Virtual hard disk (.vhd) file, click Browse, navigate to the location of the .vhd file for VM3, click Open, and then click OK.
   
   
4. Restart VM2, and then use Windows Explorer to locate the drive where VM3 is mounted. At an elevated command prompt, type the following command to request the offline domain join data:
   
   
   djoin /requestODJ /loadfile <filename.txt> /windowspath <path to Windows directory of the offline image>

5. Shut down VM2, and then unmount VM3 from VM2. To do this in Hyper-V, right-click VM2, and then click Settings. Click the integrated device electronics (IDE) controller that corresponds to VM3, and then click Remove.
   
   
6. Start VM3. The computer will be joined to the domain after it starts.
   
   

If you experience any problems running the Djoin.exe commands, you can view the log file on VM2 at %windir%\debug\netsetup.log for more information.

To perform an offline domain join using physical computers, you can complete the following steps. The best practice in this case is to have one domain controller, one domain-joined computer to use as a provisioning server, and one client computer that you want to join to the domain.

1. On the provisioning server, open an elevated command prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
   
   
2. Type the following command to provision the computer account:
   
   
   djoin /provision /domain <domain to be joined> /machine <name of the destination computer> /savefile blob.txt

3. Copy the blob.txt file to the client computer.
   
   
4. On the client computer, open an elevated command prompt, and then type the following command to request the domain join:
   
   
   djoin /requestODJ /loadfile blob.txt /windowspath %SystemRoot% /localos

   Caution
   You cannot run this command with the /localos parameter on a domain controller.

5. Reboot the client computer. The computer will be joined to the domain.
   
   

To perform an offline domain join during an operating system installation, you must first run Djoin.exe to provision the computer account metadata. Then, you create an Unattend.xml file and include a new section in it for the offline domain join data. In the new section, you can insert the computer account metadata.

The component name for the new section is Microsoft-Windows-UnattendJoin/Identification/Provisioning, and it includes the following structure:

• <Component>
  
  
• <Component name=Microsoft-Windows-UnattendedJoin>
  
  
•      <Identification>
  
  
•           <Provisioning>
  
  
•                <AccountData>Base64Encoded Blob</AccountData>
  
  
•           </Provisioning>
  
  
•      </Identification>
  
  
• </Component>
  
  

You have to insert the computer account metadata within the <AccountData> and </AccountData> tags. After you create the Unattend.xml file, start the computer that you want to join to the domain in Safe Mode or start the computer in Windows Preinstallation Environment (Windows PE), and then run the setup command with an answer file, as shown in the following example:

setup /unattend:<answer_file_path>