Deployment using a standard user to domain join, not a domain admin [Solved]

[markwilfan]

Thought I'd pass this on in case it helps anybody else.

 

We are using SCCM 2012 R2 for OSD and as I'm a good boy I'm using a standard account to domain join with rights delegated to the right OU. All was working fine; then just stopped working. After lots and lots of troubleshooting, finally found this in a sysprep log "netjoindomain error 8557" which let me to ConfigManager OSD : Joining machines to a domain and its security | System Center Configuration Manager

 

Turns out by default normal users can only join 10 machines to a Domain. As our OUs are read only to our standard users I just cleared the value; et voila.

 

For those of you using a domain admin account to domain join in sccm or mdt just remember the shares are read only to all and snooping students could find their way into the unattend.xml files.

 

Hope it helps somebody one day

[ITGuyWestMidlands]

I thought the password was stored in the sccm database if you use tge task sequence network settings option to join it to the domain? Are you using mdt with sccm?

[markwilfan]

Ah yes sorry itguy. You are correct. Only a security risk if you are using mdt or sccm with mdt . Still good practice though