0

I am currently helping my company prototype automated Windows installation via network. I am using Server 2008r2 and Windows Deployment Services with Windows 7 as the OS being installed on the client computer. Everything works fine EXCEPT joining the client PC to the domain. DNS is configured correctly, client computer is already prestaged in Active Directory Computers as the user "Client1" with a password of "password". I have posted my unattend xml file and the relevant section of the Panther/UnattendGC setupact.log and setuperr.log files.

Setupact.log:

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Begin

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Loading input parameters...

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: AccountData = [NULL]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: UnsecureJoin = [NULL]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: MachinePassword = [secret not logged]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: JoinDomain = [master.local]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: JoinWorkgroup = [NULL]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Domain = [master.local]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Username = [Client1]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Password = [secret not logged]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: MachineObjectOU = [NULL]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: DebugJoin = [false]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: DebugJoinOnlyOnThisError = [NULL]

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Checking that auto start services have started.

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Joining domain [master.local]...

2017-06-29 09:25:04, Info [DJOIN.EXE] Unattended Join: Calling DsGetDcName for master.local...

2017-06-29 09:25:04, Warning [DJOIN.EXE] Unattended Join: DsGetDcName failed: 0x2746, last error is 0x0, will retry in 5 seconds... [[[My personal note: At this point it retries and displays the above error many more times before finally quitting]]]

2017-06-29 09:32:04, Error [DJOIN.EXE] Unattended Join: NetJoinDomain failed error code is [10054]

2017-06-29 09:32:04, Error [DJOIN.EXE] Unattended Join: Unable to join; gdwError = 0x2746

2017-06-29 09:32:04, Info [DJOIN.EXE] Unattended Join: Exit, returning 0x0

Setuperr.log:

2017-06-29 09:32:04, Error [DJOIN.EXE] Unattended Join: NetJoinDomain failed error code is [10054]

2017-06-29 09:32:04, Error [DJOIN.EXE] Unattended Join: Unable to join; gdwError = 0x2746

Unattend.xml:

<?xml version='1.0' encoding='utf-8'?> <unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="specialize" wasPassProcessed="true"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <AutoLogon> <Password>*SENSITIVE*DATA*DELETED*</Password> <Domain>master.local</Domain> <Enabled>true</Enabled> <LogonCount>5</LogonCount> <Username>Client1</Username> </AutoLogon> <RegisteredOrganization>MyCompany</RegisteredOrganization> <RegisteredOwner>MyCompany</RegisteredOwner> <TimeZone>eastern standard time</TimeZone> <ComputerName></ComputerName> <ProductKey>*SENSITIVE*DATA*DELETED*</ProductKey> </component> <component name="Microsoft-Windows-DNS-Client" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <Interfaces> <Interface wcm:action="add"> <DNSServerSearchOrder> <IpAddress wcm:action="add" wcm:keyValue="1">122.45.36.1</IpAddress> </DNSServerSearchOrder> <DisableDynamicUpdate>false</DisableDynamicUpdate> <DNSDomain>master.local</DNSDomain> <EnableAdapterDomainNameRegistration>true</EnableAdapterDomainNameRegistration> <Identifier>Local Area Connection</Identifier> </Interface> </Interfaces> <DNSDomain>master.local</DNSDomain> <UseDomainNameDevolution>false</UseDomainNameDevolution> <DNSSuffixSearchOrder> <DomainName wcm:action="add" wcm:keyValue="1">master.local</DomainName> </DNSSuffixSearchOrder> </component> <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <Identification> <Credentials> <Domain>master.local</Domain> <Password>*SENSITIVE*DATA*DELETED*</Password> <Username>Client1</Username> </Credentials> <JoinDomain>master.local</JoinDomain> <DebugJoin>false</DebugJoin> </Identification> </component> </settings> <settings pass="oobeSystem" wasPassProcessed="true"> <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <Display> <ColorDepth>32</ColorDepth> <DPI>96</DPI> <HorizontalResolution>1280</HorizontalResolution> <RefreshRate>60</RefreshRate> <VerticalResolution>1024</VerticalResolution> </Display> <UserAccounts> <AdministratorPassword>*SENSITIVE*DATA*DELETED*</AdministratorPassword> <DomainAccounts> <DomainAccountList wcm:action="add"> <Domain>master.local</Domain> <DomainAccount wcm:action="add"> <Group>Domain Users</Group> <Name>Client1</Name> </DomainAccount> </DomainAccountList> </DomainAccounts> <LocalAccounts> <LocalAccount wcm:action="add"> <Password>*SENSITIVE*DATA*DELETED*</Password> <Description>MyCompany</Description> <DisplayName>MyCompany</DisplayName> <Name>MyCompany</Name> <Group>Administrators</Group> </LocalAccount> </LocalAccounts> </UserAccounts> <TimeZone>eastern standard time</TimeZone> <RegisteredOwner>MyCompany</RegisteredOwner> <RegisteredOrganization>MyCompany</RegisteredOrganization> <OOBE> <HideEULAPage>true</HideEULAPage> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> </OOBE> </component> <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <InputLocale>en-us</InputLocale> <SystemLocale>en-us</SystemLocale> <UILanguage>en-us</UILanguage> <UILanguageFallback>en-us</UILanguageFallback> <UserLocale>en-us</UserLocale> </component> </settings> <cpi:offlineImage cpi:source="catalog://51esm549353-6/reminst/wdsclientunattend/windows 7 professional_windows 7 professional.clg" xmlns:cpi="urn:schemas-microsoft-com:cpi"></cpi:offlineImage> </unattend>

I have already tried turning true and it still didn’t work. Notably, I didn’t include credentials when I set UnsecureJoin to true because you are NOT supposed to include credentials when performing UnsecureJoin. Additionally, I tried variations of UnsecureJoin=true with MachinePassword set to that machine’s local admin account password and also with the MachinePassword field blank and it STILL did not work.

Can someone help me figure out why the client pc is not joining the domain at all? Additionally, DsGetDCName error code 0x2746 and NetJoinDomain error code 10054 seem to be undocumented, so any insight into these error codes would be greatly appreciated?

  • The Djoin log message reads like it's not finding the Domain Controller. – Davidw Jul 3 '17 at 20:19
  • Just to rule out the obvious, are the clocks on the client and server synchronized? Authentication will fail if the clocks differ past a maximum threshold. – Charles Burge Jul 6 '17 at 0:23
0

Here's how I do this: In WDS there are 2 distinct parts to the answer files, I usually save these in separate files - the winPE bit (which connects to server, paritions disk, copies files onto workstation, sets up insecure join) and the OOBE bit (which sets local passwords, locales, finishes domain join). You link the PE file to the machine or set it globally, and you link the OOBE file to the image in the 'allow unattended install' bit.

Here's a link to my ragtag notes on WDS

Here are my files: PE.xml (for UEFI - you'll need to change the drive partitioning for non UEFI boot):

    <?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
    <settings pass="windowsPE">
        <component name="Microsoft-Windows-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">
            <WindowsDeploymentServices>
                <Login>
                    <WillShowUI>OnError</WillShowUI>
                    <Credentials>
                        <Username>wdsinst</Username>
                        <Domain>beastquest.com</Domain>
                        <Password>AbCd1234</Password>
                    </Credentials>
                </Login>
                <ImageSelection>
                    <WillShowUI>OnError</WillShowUI>
                    <InstallImage>
                        <ImageGroup>Win10</ImageGroup>
                        <ImageName>Win10x64take5</ImageName>
                        <Filename>win10x64take5.wim</Filename>
                    </InstallImage>
                    <InstallTo>
                        <DiskID>0</DiskID>
                        <PartitionID>3</PartitionID>
                    </InstallTo>
                </ImageSelection>
            </WindowsDeploymentServices>
            <DiskConfiguration>
                <WillShowUI>OnError</WillShowUI>
                <Disk wcm:action="add">
                   <CreatePartitions>
                       <CreatePartition wcm:action="add">
                           <Type>EFI</Type> 
                           <Size>200</Size> 
                           <Order>1</Order> 
                       </CreatePartition>
                       <CreatePartition wcm:action="add">
                            <Order>2</Order> 
                            <Size>128</Size> 
                            <Type>MSR</Type> 
                       </CreatePartition>
                       <CreatePartition wcm:action="add">
                            <Extend>true</Extend> 
                            <Order>3</Order> 
                            <Type>Primary</Type> 
                       </CreatePartition>
                  </CreatePartitions>
                    <ModifyPartitions>
                        <ModifyPartition wcm:action="add">
                            <Active>true</Active>
                            <Format>FAT32</Format>
                            <Label>EFI</Label>
                            <Order>1</Order>
                            <PartitionID>1</PartitionID>
                        </ModifyPartition>
                        <ModifyPartition wcm:action="add">
                            <Order>2</Order>
                            <PartitionID>3</PartitionID>
                            <Format>NTFS</Format>
                            <Label>Windows</Label>
                        </ModifyPartition>
                    </ModifyPartitions>
                    <DiskID>0</DiskID>
                    <WillWipeDisk>true</WillWipeDisk>
                </Disk>
            </DiskConfiguration>
 <ImageInstall>
 <OSImage>
 <InstallTo>
 <PartitionID>3</PartitionID> 
 <DiskID>0</DiskID> 
 </InstallTo>
 </OSImage>
 </ImageInstall>
        </component>
        <component name="Microsoft-Windows-International-Core-WinPE" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">
      <SetupUILanguage>
 <UILanguage>en-US</UILanguage>
   </SetupUILanguage>
    </component>
    </settings>
</unattend>

Change the image details to suit your images.

and OOBE.xml: Link this to the install image you specified above (as the allow unattend file):)

    <?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <Identification>
                <UnsecureJoin>true</UnsecureJoin>
            </Identification>
        </component>
    </settings>
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <NetworkLocation>Work</NetworkLocation>
                <ProtectYourPC>1</ProtectYourPC>
                <SkipMachineOOBE>true</SkipMachineOOBE>
                <SkipUserOOBE>true</SkipUserOOBE>
            </OOBE>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="catalog:c:/win7-64bit/sources/install_windows 7 professional.clg" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

You also need to grant some permissions to the WDSInst account so that it can manage the computer accounts in AD. Set the OU you want new computer accounts created in the WDS server properties, then grant delegated permisions to wdsinst to that OU. The account will need:

  • Create/delete computer accounts in this + all sub OUs
  • in this + all sub OUs permissions to do the following to computer objects:
    • Read/write account restrictions
    • validated Write to SPN and DNS hostname
    • change + reset password

You can't use a Domain admin account. you need to give wdsinst as few permissions as possible, as these answer files are not super secure (the PE one is TFTP'd across I think).

This works for Win7 -> win10

| improve this answer | |
  • I have already separated the winPE xml and OOBE xml file prior to posting this question so I don't think unattend xml structure is the source of the problem. I did take your advice about granting delegated permissions to my OU but I do not know how to grant permissions to wdsinst (the server) within OU? Anyways, I tried to give the default OU group "Computers" full control for testing but I could not find the validated write to SPN/DNS hostname permissions such as "Validated write to DNS hostname permission" under Property Specific Permissions? – Novaitguy Jul 7 '17 at 13:36
  • For setting the permissions see: support.microsoft.com/en-gb/help/932455 – Jim ReesPotter Jul 8 '17 at 19:53
  • Looking at your logs though, it does look like it fails at fining a DC rather than failing to join the domain once it has joined. Can you join a client manually OK? Is you DHCP/DNS all OK? You have only posted the Specialize/OOBE bit of your answer files here, but I think the setupacct errors are from the PE part of the build, do you have a <settings pass="pe" ....> in your answer files anywhere? – Jim ReesPotter Jul 8 '17 at 19:59
  • I can join a client manually to the domain just fine. My DHCP is issuing addresses correctly and the DNS on both client and server side is set up correctly also. My PE pass is in my boot unattended answer file (the winPE bit) which is read in by the WDS server rather than in the image-specific OOBE unattend file, which is also the exact same way that you segmented your two unattend files. – Novaitguy Jul 10 '17 at 21:00
  • The only other thing I can see is that you've got an entry in there for a DNS server. Shouldn't it get that from DHCP? And it's a public one too, so won't necessarily resolve your domain. .. – Jim ReesPotter Jul 11 '17 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.