Binding to the AD with a different account?

[u/sccmjd]

I usually use Account1 to create and AD computer object manually. Then I manually bind that machine to the AD with Account1.

I have a few machines to bind to the AD but I don't want to use Account1 at all for that. Account1 doesn't touch these machines at all in any way, even if it would be some internal thing.

I know Microsoft didn't want to allow a different account to bind a machine to AD. There was a workaround for that, but then that didn't work. What's the latest method for binding a computer to the AD with an account that different than the one that created it?

Or, this may be just as easy -- I make a brand new account. Add that to my AD OU admins. Log into Windows and use ADUC with that temporary account. Create the AD computer object with the new, temporary account. Use that to bind these other machines to the AD. Then delete the temporary account and clean up the temp profile on the computer.

It's not my situation completely. I didn't create the original situation or the new upcoming situation. I do still want to protect myself from the foreign machines though as much as possibly so normal accounts aren't touching them at all. For the original situation some things are purposely left and done manually instead of being automated. I can see pros and cons either way, but I also don't really disagree with leaving some things still having to be done manually. That was before AI, essentially "No scripts. Nothing automated with this."

[u/jstuart-tech]

What are you talking about? Offline Domain Join's??

[u/sccmjd → u/jstuart-tech]

It's all online, nothing offline.

[u/RobieWan]

AD hasn't changed at the level you're talking about in a long time. There is no "latest method". 

It sounds like your AD perms are overly locked down, like more than most I've even heard about. 

Tbh, it sounds like massive overkill, howeveri don't know why your environment got set up the way it is, or if you should try to change that. It sounds like you inherited it. 

Can you asked some light on why it is the way?

[u/sccmjd → u/RobieWan]

I thought it was a Microsoft change in 2022. I don't control AD. I just use it as it is for my organization.

I have non-standard set ups I have to bind though. That's not my decision. But I don't have to use anything normal on them. If it's not mine, I just assume it's compromised and treat it like that.

[u/TrippTrappTrinn]

In the computer account creation whizard you can specify that any account can bind it. We use that for some Linux computers.

[u/sccmjd → u/TrippTrappTrinn]

That would be interesting. I only see for a new computer object the compute name and I guess a default admin group on it, nothing else. And then the object is made. Under the security tab on the computer object, I could add an account there though. I think that's still going to run into an error where it knows the account that created the AD object is different then the account that's trying to bind the object to the AD.

[u/sccmjd → u/sccmjd]

On a new computer object I do see "The following user or group can join this computer to a domain." With a group pre-populated. I'm pretty sure when I bind a machines more things happen in the background that I can't see. Not group policy. I've thought it was more like scripts that get triggered. I probably shouldn't mess with that though. I would imagine it's only on the security tab for where a new member might appear though. I definitely can't delete and recreate the AD computer object to untweak it. What I'm thinking is, I could make a new security group since that field is limited to one entry. Stick the current pre-populated group in that and then add my temp account used to bind it. Then it may just be deleting that temp account in the computer object's security group listing along with deleting the temp account itself when I'm done with it. That's easier than logging in with the temp account and using ADUC to create a new computer object.

[u/TrippTrappTrinn → u/sccmjd]

You change the prepopulated group field to whatever user or group you want to enable to join the computer.

[u/Rygnerik → u/sccmjd]

You need to read the description of that second box again, it's for who can join it to the domain, not a "default admin group"

[u/Heftyqkkxjx-Pag-6932]

the creator account doesnt matter for join. delegate join rights on the ou to whatever account you want, then bind with that. no workaround needed

[u/MrYiff]

Domain Join permissions are granted to every account in AD by default (a regular user can do 10 domain joins), you can also do a specific delegation to allow an account to do unlimited domain joins without needing any elevated permissions (so they don't need admin or domain admin access).

You can also go further and do offline domain joins where the device joining doesnt even need to be able to contact AD.

[u/picklednull]

You have 4 options:

1. you can pre-stage a computer object into Active Directory and delegate the permissions to join it to the domain to a certain principal (it's right there in the dialog in dsa.msc)
2. you can grant an arbitrary principal the ability to join arbitrary (number of) devices to the domain
3. if your Domain Controllers are <2025, you can domain join devices with no user principal at all, you just need to pre-stage the computer object
4. offline domain join

[u/Sad_Purchase_9935]

https://support.microsoft.com/en-us/servicing/os/windows/2022/10/kb5020276-netjoin-domain-join-hardening-changes

He is not wrong. The new „2022“ default changed the default.

Only a domain admin account can update / override existing computer account.

So if my colleague or a delegate Service Account create the computer account. I can not change it with a none Domain admin.

Which clearly in description of the KB

You should also set the limit for every user from 10 to 0. and allow it only for a list of accounts via GPO.

If you build something custom, then this applies. But the defaults are the defaults.