1

What is the preferred method to programatically join a windows 7 machine to the domain?

I want to script this so that when a newly imaged machine is booted up it joins the domain. (I don't want to use Sysprep to do it as there are some other checks I want to run at the same time.)

As far as I can see, I can either use NetDom, or computer-add in Powershell.

Both of these theoretically mean I have to install "extra stuff" on the image, though - either RSAT to use netdom (or I could manually copy just that command) or the AD cmdlets for computer-add.

Anyone have any experience of these, or which is the "better" way? I don't really want to leave the end users with admin tools on their machines.

Thanks in advance,

Ben

Improve this question
3
  • You could set it so the executables on those tools once run will be set to access only by the local or domain admin. Users will have the tools but can't use them.
    – Bart Silverstrim
    Jun 24, 2010 at 11:26
  • Keeping "admin tools" from users is security by obscurity; and they'll just download the tools off the Internet if they want them. Best to have a properly secured network than to hope your users don't figure out how to break things.
    – Chris S
    Jun 24, 2010 at 12:55
  • Fair point well made!
    – Ben
    Jun 24, 2010 at 13:02

2 Answers 2

Reset to default
5

NETDOM.EXE is all you need. I'd just copy it over and be done with it.

There's no danger in the user having NETDOM.EXE. The same functionality that NETDOM exposes is available in the GUI anyway. So long as the user doesn't have a domain credential with rights to join / disjoin computers from the domain they can't harm your AD with the NETDOM tool. Likewise, if the user isn't a local Administrator of the PC they can't use NETDOM to make the PC believe it's disjoined from the domain any more than using the GUI tools.

Just be sure that you're not leaving credentials on the PC, post-imaging, that could give the user privileged access to the AD.

Improve this answer
2
  • netdom is included with Windows 7 by default (in the business versions). Also just a note; by default any domain user can join a computer to your domain. Directions for disabling that: social.technet.microsoft.com/Forums/en/winserverDS/thread/…
    – Chris S
    Jun 24, 2010 at 12:52
  • 1
    @Chris S: Good call on NETDOM being included-- I didn't bother to look because I'm so used to copying it onto XP images as part of the pile of utility files that I end up installing on most XP images. re: any user joining computers to the domain - The uesr would still need "Administrator" rights on the local computer (which, hopefully, they don't have) to affect the computer's domain membership.
    – Evan Anderson
    Jun 24, 2010 at 13:01
2

PowerShell is on by default in Windows 7, check the Add-Computer cmdlet.

http://go.microsoft.com/fwlink/?LinkID=135194

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .