Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the preferred method to programatically join a windows 7 machine to the domain?

I want to script this so that when a newly imaged machine is booted up it joins the domain. (I don't want to use Sysprep to do it as there are some other checks I want to run at the same time.)

As far as I can see, I can either use NetDom, or computer-add in Powershell.

Both of these theoretically mean I have to install "extra stuff" on the image, though - either RSAT to use netdom (or I could manually copy just that command) or the AD cmdlets for computer-add.

Anyone have any experience of these, or which is the "better" way? I don't really want to leave the end users with admin tools on their machines.

Thanks in advance,

Ben

share|improve this question
    
You could set it so the executables on those tools once run will be set to access only by the local or domain admin. Users will have the tools but can't use them. –  Bart Silverstrim Jun 24 '10 at 11:26
    
Keeping "admin tools" from users is security by obscurity; and they'll just download the tools off the Internet if they want them. Best to have a properly secured network than to hope your users don't figure out how to break things. –  Chris S Jun 24 '10 at 12:55
    
Fair point well made! –  Ben Jun 24 '10 at 13:02

2 Answers 2

up vote 5 down vote accepted

NETDOM.EXE is all you need. I'd just copy it over and be done with it.

There's no danger in the user having NETDOM.EXE. The same functionality that NETDOM exposes is available in the GUI anyway. So long as the user doesn't have a domain credential with rights to join / disjoin computers from the domain they can't harm your AD with the NETDOM tool. Likewise, if the user isn't a local Administrator of the PC they can't use NETDOM to make the PC believe it's disjoined from the domain any more than using the GUI tools.

Just be sure that you're not leaving credentials on the PC, post-imaging, that could give the user privileged access to the AD.

share|improve this answer
    
netdom is included with Windows 7 by default (in the business versions). Also just a note; by default any domain user can join a computer to your domain. Directions for disabling that: social.technet.microsoft.com/Forums/en/winserverDS/thread/… –  Chris S Jun 24 '10 at 12:52
1  
@Chris S: Good call on NETDOM being included-- I didn't bother to look because I'm so used to copying it onto XP images as part of the pile of utility files that I end up installing on most XP images. re: any user joining computers to the domain - The uesr would still need "Administrator" rights on the local computer (which, hopefully, they don't have) to affect the computer's domain membership. –  Evan Anderson Jun 24 '10 at 13:01

PowerShell is on by default in Windows 7, check the Add-Computer cmdlet.

http://go.microsoft.com/fwlink/?LinkID=135194

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.