3

Is it possible to have a previously domain connected client computer re-join a Windows domain after a clean re-install of the OS, to assume again it's old identity, all without the explicit say-so of the domain admin?

Does the answer vary depending on which authentication protocol is being used?

3

No. Domain Admin certainly is not required, but elevated permissions will need to be delegated. The authentication protocol is not relevant.

More permissions are required to re-join a computer than to join a computer due to there are permissions required to modify the existing computer account object. There are two ways to do this: reset the computer account object, or delegate specific permissions to the objects/containers where the computers exist/will be joined/staged.

Additionally, the computer account dynamic dns record is usually orphaned during this process, so the security principal performing the join would also need permission to change the owner of the DNS A record.

  • Thank you for taking the time to answer. Just a follow up: Without any permissions other than those of a local administrator's, re-joining the domain would not be possible? – Oskar Lindberg Feb 28 '16 at 14:03
  • No, unless the person performing the activity were the object owner. When a computer is joined to the domain, the owner may be the account that performed the join. In that case, they may be able to do it, but I would not rely on that. – Greg Askew Feb 28 '16 at 14:46
  • Thanks again. I'm somewhat surprised that whatever information is stored locally, and that is required for identifying the client to the domain, cannot be restored. I'll probably have to ask another question about that later. – Oskar Lindberg Feb 28 '16 at 15:02
  • 1
    The "piece" is the LSA shared secret. It isn't possible without restoring system state from backup. – Greg Askew Feb 28 '16 at 17:00
  • 1
    I can't imagine how that would help anyone restore a computer account domain membership, particularly when there are far easier and simpler methods to achieve the same desired end result. – Greg Askew Feb 28 '16 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.