{"id":2838,"date":"2014-02-15T15:27:27","date_gmt":"2014-02-15T07:27:27","guid":{"rendered":"http:\/\/rmohan.com\/?p=2838"},"modified":"2014-02-15T15:27:27","modified_gmt":"2014-02-15T07:27:27","slug":"2012-offline-domain-join-concept","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=2838","title":{"rendered":"2012 Offline Domain Join &#8211; Concept"},"content":{"rendered":"<p>t involves 2 steps:<br \/>\n1. Provisioning (On Domain Controller)<br \/>\n2. Offline Domain Join (On Client Machine)<\/p>\n<p><strong>Provisioning<\/strong><br \/>\nIn this process, it will create an account for the client machine in Active Directory and will provide a file (BLOB) which will have the complete information about the domain controller and the domain which the client machine requires to join to the domain<\/p>\n<p>We will use\u00a0<strong>DJoin\u00a0<\/strong>Utility (Inbuilt in Windows 2008)<br \/>\nRun the following command on the domain controller<\/p>\n<p>DJoin \/Provision \/Domain &lt;Domain Name&gt; \/Machine &lt;Name of Client Machine&gt; \/SaveFile &lt;File Name + Location&gt;<\/p>\n<p>DJoin \/Provision \/Domain\u00a0ds.com \/Machine\u00a0WinXP-DS \/SaveFile C:\\Offline.txt<\/p>\n<p>The file &#8220;Offline.txt&#8221; will now have all the necessary information required by the client to join itself to the domain<\/p>\n<p><strong>Offline Domain Join\u00a0<\/strong><br \/>\nIn this process, the text file (BLOB) that is created while provisioning is used on the client machine to join that client machine to the domain even in the absence of network connectivity between the client and the domain controller<br \/>\nRun the following command on the Client Machine or on the Member Server<\/p>\n<p>DJoin \/Requestobj \/Loadfile &lt;File Name + Location&gt; \/WindowsPath %SystemRoot%\\LocalOS<\/p>\n<p>DJoin \/Requestobj \/Loadfile\u00a0C:\\Offline.txt \/WindowsPath %SystemRoot%\\LocalOS<\/p>\n<p>(In some cases, you might get an error after running the above command. The error could be &#8220;Error 57: File not Found&#8221;. In that situation, do not use .txt as the extension to save the file. Instead, use .djoin extension while saving the file on the DC and then using the same file with .djoin extension on the client machine)<\/p>\n<p>In case of any errors, do check the Netsetup Log<\/p>\n<p>Note: You cannot join a domain controller using this method. You can only join a client machine or a member server suing offline domain join<\/p>\n<p>&nbsp;<\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Offline domain join overview<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>Introduced in Windows Server 2008 R2, domain controllers include a feature called Offline Domain Join. A command line utility named Djoin.exe lets you join a computer to a domain without physically contacting a domain controller while completing the domain join operation. The general steps for using Djoin.exe are:<\/p>\n<ol>\n<li>Run\u00a0<strong>djoin \/provision<\/strong>\u00a0to create the computer account metadata. The output of this command is a .txt file that includes a base-64 encoded blob.<\/li>\n<li>Run\u00a0<strong>djoin \/requestODJ<\/strong>\u00a0to insert the computer account metadata from the .txt file into the Windows directory of the destination computer.<\/li>\n<li>Reboot the destination computer, and the computer will be joined to the domain.<\/li>\n<\/ol>\n<p><a id=\"BKMK_ODJOverview\"><\/a><\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Offline domain join with DirectAccess policies scenario overview<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>DirectAccess offline domain join is a process that computers running Windows Server 2012 and Windows 8can use to join a domain without being physically joined to the corporate network, or connected through VPN. This makes it possible to join computers to a domain from locations where there is no connectivity to a corporate network. Offline domain join for DirectAccess provides DirectAccess policies to clients to allow remote provisioning.<\/p>\n<p>&nbsp;<\/p>\n<p>A domain join creates a computer account and establishes a trust relationship between a computer running a Windows operating system and an Active Directory\u00ae domain.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Prepare for offline domain join<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>Create the machine account.<\/li>\n<li>Inventory the membership of all security groups to which the machine account belongs.<\/li>\n<li>Gather the required computer certificates, group policies, and group policy objects to be applied to the new client(s).<\/li>\n<\/ol>\n<p>. The following sections explain operating system requirements and credential requirements for performing a DirectAccess offline domain join using Djoin.exe.<\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Operating system requirements<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>You can run Djoin.exe for DIrectAccess only on computers that run Windows Server 2012 or Windows 8. The computer on which you run Djoin.exe to provision computer account data into AD\u00a0DS must be running Windows Server 2012 or Windows 8. The computer that you want to join to the domain must also be running Windows Server 2012 or Windows 8.<\/p>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Credential requirements<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>To perform an offline domain join, you must have the rights that are necessary to join workstations to the domain. Members of the Domain Admins group have these rights by default. If you are not a member of the Domain Admins group, a member of the Domain Admins group must complete one of the following actions to enable you to join workstations to the domain:<\/p>\n<ul>\n<li>Use Group Policy to grant the required user rights. This method allows you to create computers in the default Computers container and in any organizational unit (OU) that is created later (if no Deny access control entries (ACEs) are added).<\/li>\n<li>Edit the access control list (ACL) of the default Computers container for the domain to delegate the correct permissions to you.<\/li>\n<li>Create an OU and edit the ACL on that OU to grant you the\u00a0<strong>Create child \u2013 Allow<\/strong>\u00a0permission. Pass the\u00a0<strong>\/machineOU<\/strong>\u00a0parameter to the\u00a0<strong>djoin \/provision<\/strong>\u00a0command.<\/li>\n<\/ul>\n<p>The following procedures show how to grant the user rights with Group\u00a0Policy and how to delegate the correct permissions.<\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Granting user rights to join workstations to the domain<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>You can use the Group Policy Management Console (GPMC) to modify the domain policy or create a new policy that has settings that grant the user rights to add workstations to a domain.<\/p>\n<p>Membership in\u00a0<strong>Domain Admins<\/strong>, or equivalent, is the minimum required to grant user rights. Review details about using the appropriate accounts and group memberships at\u00a0<a href=\"http:\/\/go.microsoft.com\/fwlink\/?LinkId=83477\">Local and Domain Default Groups<\/a>\u00a0(http:\/\/go.microsoft.com\/fwlink\/?LinkId=83477).<\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">To grant rights to join workstations to a domain<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>Click\u00a0<strong>Start<\/strong>, click\u00a0<strong>Administrative Tools<\/strong>, and then click\u00a0<strong>Group Policy Management<\/strong>.<\/li>\n<li>Double-click the name of the forest, double-click\u00a0<strong>Domains<\/strong>, double-click the name of the domain in which you want to join a computer, right-click\u00a0<strong>Default Domain Policy<\/strong>, and then click\u00a0<strong>Edit<\/strong>.<\/li>\n<li>In the console tree, double-click\u00a0<strong>Computer Configuration<\/strong>, double-click\u00a0<strong>Policies<\/strong>, double-click\u00a0<strong>Windows Settings<\/strong>, double-click\u00a0<strong>Security Settings<\/strong>, double-click<strong>Local Policies<\/strong>, and then double-click\u00a0<strong>User Rights Assignment<\/strong>.<\/li>\n<li>In the details pane, double-click\u00a0<strong>Add workstations to domain<\/strong>.<\/li>\n<li>Select the\u00a0<strong>Define these policy settings<\/strong>\u00a0check box, and then click\u00a0<strong>Add User or Group<\/strong>.<\/li>\n<li>Type the name of the account that you want to grant the user rights to, and then click\u00a0<strong>OK<\/strong>\u00a0twice.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Offline domain join process<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>Run Djoin.exe at an elevated command prompt to provision the computer account metadata. When you run the provisioning command, the computer account metadata is created in a binary file that you specify as part of the command.<\/p>\n<p>For more information about the NetProvisionComputerAccount function that is used to provision the computer account during an offline domain join, see<a href=\"http:\/\/go.microsoft.com\/fwlink\/?LinkId=162426\">NetProvisionComputerAccount Function<\/a>\u00a0(http:\/\/go.microsoft.com\/fwlink\/?LinkId=162426). For more information about the NetRequestOfflineDomainJoin function that runs locally on the destination computer, see\u00a0<a href=\"http:\/\/go.microsoft.com\/fwlink\/?LinkId=162427\">NetRequestOfflineDomainJoin Function<\/a>\u00a0(http:\/\/go.microsoft.com\/fwlink\/?LinkId=162427).<\/p>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Steps for performing a DirectAccess offline domain join<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<p>The offline domain join process includes the following steps:<\/p>\n<ol>\n<li>Create a new computer account for each of the remote clients and generate a provisioning package using the Djoin.exe command from an already domain joined computer in the corporate network.<\/li>\n<li>Add the client computer to the DirectAccessClients security group<\/li>\n<li>Transfer the provisioning package securely to the remote computers(s) that will be joining the domain.<\/li>\n<li>Apply the provisioning package and join the client to the domain.<\/li>\n<li>Reboot the client to complete the domain join and establish connectivity.<\/li>\n<\/ol>\n<div>\n<p>There are two options to consider when creating the provisioning packet for the client. If you used the Getting Started Wizard to install DirectAccess without PKI, then you should use option 1 below. If you used the Advanced Setup Wizard to install DirectAccess with PKI, then you should use option 2 below.<\/p>\n<p>Complete the following steps to perform the offline domain join:<\/p>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Option1: Create a provisioning package for the client without PKI<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>At a command prompt of your Remote Access server, type the following command to provision the computer account:\n<div id=\"code-snippet-1\">\n<div><\/div>\n<div>\n<div><\/div>\n<div dir=\"ltr\" id=\"CodeSnippetContainerCode_9be766b6-e1b4-4d94-8727-3b552f4cd8d8\">\n<div>\n<pre>Djoin \/provision \/domain &lt;your domain name&gt; \/machine &lt;remote machine name&gt; \/policynames DA Client GPO name \/rootcacerts \/savefile c:\\files\\provision.txt \/reuse<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Option2: Create a provisioning package for the client with PKI<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>At a command prompt of your Remote Access server, type the following command to provision the computer account:\n<div id=\"code-snippet-2\">\n<div><\/div>\n<div>\n<div><\/div>\n<div dir=\"ltr\" id=\"CodeSnippetContainerCode_296c19d5-53a8-46e7-a0fe-b99590cd2aad\">\n<div>\n<pre>Djoin \/provision \/machine &lt;remote machine name&gt; \/domain &lt;Your Domain name&gt; \/policynames &lt;DA Client GPO name&gt; \/certtemplate &lt;Name of client computer cert template&gt; \/savefile c:\\files\\provision.txt \/reuse<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Add the client computer to the DirectAccessClients security group<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>On your Domain Controller, from\u00a0<strong>Start<\/strong>\u00a0screen, type\u00a0<strong>Active<\/strong>\u00a0and select\u00a0<strong>Active Directory Users and Computers<\/strong>\u00a0from\u00a0<strong>Apps<\/strong>\u00a0screen.<\/li>\n<li>Expand the tree under your domain, and select the\u00a0<strong>Users<\/strong>\u00a0container.<\/li>\n<li>In the details pane, right-click\u00a0<strong>DirectAccessClients<\/strong>, and click\u00a0<strong>Properties<\/strong>.<\/li>\n<li>On the\u00a0<strong>Members<\/strong>\u00a0tab, click\u00a0<strong>Add<\/strong>.<\/li>\n<li>Click\u00a0<strong>Object Types\u2026<\/strong>, select\u00a0<strong>Computers<\/strong>, and then click\u00a0<strong>OK<\/strong>.<\/li>\n<li>Type the client name to add, and then click\u00a0<strong>OK<\/strong>.<\/li>\n<li>Click\u00a0<strong>OK<\/strong>\u00a0to close the\u00a0<strong>DirectAccessClients<\/strong>\u00a0Properties dialog, and then close\u00a0<strong>Active Directory Users and Computers<\/strong>.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<div>\n<div><a title=\"Click to collapse. Double-click to collapse all.\">Copy and then apply the provisioning package to the client computer<\/a><\/p>\n<div>\n<hr \/>\n<\/div>\n<\/div>\n<div>\n<ol>\n<li>Copy the provisioning package from c:\\files\\provision.txt on the Remote Access Server, where it was saved, to c:\\provision\\provision.txt on the client computer.<\/li>\n<li>On the client computer, open an elevated command prompt, and then type the following command to request the domain join:\n<div id=\"code-snippet-3\">\n<div><\/div>\n<div>\n<div><\/div>\n<div dir=\"ltr\" id=\"CodeSnippetContainerCode_282689b6-04e3-4c1c-b98c-7d43b76eda65\">\n<div>\n<pre>Djoin \/requestodj \/loadfile C:\\provision\\provision.txt \/windowspath %windir% \/localos<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n<li>Reboot the client computer. The computer will be joined to the domain. Following the reboot, the client will be joined to the domain and have connectivity to the corporate network with DirectAccess.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>t involves 2 steps: 1. Provisioning (On Domain Controller) 2. Offline Domain Join (On Client Machine)<\/p>\n<p>Provisioning In this process, it will create an account for the client machine in Active Directory and will provide a file (BLOB) which will have the complete information about the domain controller and the domain which the client machine [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2838"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2838"}],"version-history":[{"count":2,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2838\/revisions"}],"predecessor-version":[{"id":2840,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/2838\/revisions\/2840"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}