[wds] Very odd - UEFI clients not naming/joining domain - older clients fine

[pow]

Hi all,

 

Not much really gets me like this one does but I'm stumped!!

 

I have a right mixed bag of equipment here that I'm moving all over to Windows 8.1 64 bit from the mixed XP/Vista and 7 32bit environment. I'm using WDS on Server 2012 R2 to help me with this, creating an image for each type of machine with all of the correct drivers preloaded into the image.

 

Some of my older kit (Fujitsu Esprimo Desktops, Lenovo ThinkPad 15 Laptops) don't have an EFI BIOS so the install is a standard BIOS 2 partition boot to hard disk install. I name and approve clients, they install no problem and name themselves and join to the domain, so I'm left with a machine that is left that the logon screen ready for my to deploy software via GPO.

 

The newer HP ProBooks and Dell Optiplexs here are EFI compatible, so I've switched the BIOS from legacy to EFI mode and they are working beautifully. I had to write a new WDS-Unattend to deal with the new EFI partition structure but that is all working beautifully. I still name and approve these clients in the same way and they install no problem, but prompt me for a computer name and are not joined to the domain - REALLY ANNOYING!

 

Can anyone shed any light on this?

 

Thanks,

 

David.

[AngryTechnician]

Anything telling in the C:\Windows\Panther\setupact.log or C:\Windows\Panther\setuperr.log files? The second should get straight to the point if there's an obvious error occurring.

[pow]

It seems that the EFI clients NEED %MACHINENAME% in the XML whereas the BIOS clients just don't care!!! So that's that mystery solved... just to play with the domain join now as I've been pulling the XML file apart!!!!

[pow]

Still having no luck with auto domain join, managed to get it done once but it was still asking for a machine name at that point. Any pointers would be greatly appreciated

[1steelhead]

POW ... I'm having the same problem. Did you ever get this figured out. (Both the Auto-naming and the Auto-Join Domain) ?

[hailstorm]

I realise this is an old thread but it was top of the google search results when I was looking for a fix.

 

It is a bug in WDS. When you approve a UEFI device it gives the wrong permissions. If you look under the security permissions on the computer object you will see it has set deny for Domain Admins against the 'Change password' and 'Reset password'. Remove the deny for both of these and you are good to go.

 

You will need to do this for each UEFI computer you approve through WDS but it is better than nothing.

[mavhc]

I realise this is an old thread but it was top of the google search results when I was looking for a fix.

 

It is a bug in WDS. When you approve a UEFI device it gives the wrong permissions. If you look under the security permissions on the computer object you will see it has set deny for Domain Admins against the 'Change password' and 'Reset password'. Remove the deny for both of these and you are good to go.

 

You will need to do this for each UEFI computer you approve through WDS but it is better than nothing.

 

Just come across this again in 2018, still not fixed in WDS on Server 2016 apparently (Still on 2012r2 here). Anyone confirm/tried 2019?