1803 MDT Domain Join issues

[caffrey]

I'm having issues with 1803 and domain join. I'm aware that you need to add the TLD to JoinDomain= in the rules to make this work but it's still not joining

 

I've tested the task sequence with various editions and it works fine and joins the domain no problem (1607,1709 etc.) - I just have an issue with the new 1803, even with a fresh wim straight from the iso

 

I've updated to the last WAIK

 

I think it has something to do with the fact we don't really have a proper TLD e.g.

 

C:\Users\*******>whoami /fqdn
CN=*******,OU=Network Administration,DC=THS

 

I'm also unable to join the domain from within the image too as I just get a "an active directory domain controller cannot be contacted" when trying to join

 

I'm sure it's to do with the TLD, it's an old inherited domain, I think the TLD was set to THS, but even trying to join with THS.THS doesn't work either

 

It's a drag troubleshooting MDT.... and it's the weekend so any hints would be handy

[Steve21]

If you are just using ths you'll usually need to add the reg fix to allow single label domains

 

Trying it manually to see if it works with local join should be easy test

 

Steve

[caffrey]

Perfect thanks, I'll need to add that reg key to the WIM or the task sequence. What a pain - any reason why this was done in 1803?

 

For future reference and any one else having the issue

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Add DWORD AllowSingleLabelDnsDomain = 1

[Steve21]

It's not been officially supported since about 08r2~ but guess they're finally clamping down on it more

 

Age of thing always would recommend doing it as part of sequence so it works for any new wim as no doubt you'll always have to do it with new versions

 

Steve

[snagrat]

I had the same problem at one of our smaller schools recently. Due to their small number of machines I just manually joined them at the end.

 

Would interested to know where you put the reg entry in the Task Sequence

[caffrey]

I don't think the regedit will make any difference, the problem exists with the JoinDomain= in the rules which I think now needs a FQDN e.g. I will need THS.local

 

I put it under state restore in a custom folder before domain join, I tried adding a reboot option there too - the key has applied but still no domain join

 

So 1803 with MDT and single label now appears to be broken, the only thing we can do is manually add the machines to the domain after applying the image

 

All I can do is in the summer is attempt a rendom and give the domain a FQDN

Edited June 10, 2018 by caffrey

[Steve21]

Did you try it with modifying the dns zone too? (There's 2 parts in reg to do) If it's working manually on a join there's no reason it shouldn't be working via MDT now.

 

Also at what stage are you trying to add the regkey? As if you're doing it in the state restore you've already missed the domain join unless they changed the layout? It should be under the preinstall level when it's doing the unattend.xml as that's what's joining it to the domain, if you mean the state restore domain recovery bit that's only a secondary check to see if it did join successfully. You can even add it to the unattend as an asynchronouscommand (Not used MDT on it's own in a long time so sorry if any names changed for stages )

 

Steve

[caffrey]

Fixed it, panic over (Troubleshooting MDT is tedious....) especially over a vpn onto a VM...

 

Just leave the JoinDomain= alone e.g. no FQDN

 

Add a task under task sequence like this (I think it needed a reboot before attempting to join the domain)

 

cmd.exe /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" /v AllowSingleLabelDnsDomain /t REG_DWORD /d 1 /f

 

 

I think I'll still attempt a rendom over the summer, this single label domain is bound to cause issues later, although I've had none upto now

Edited June 10, 2018 by caffrey

[Tones]

I'm in the same boat as you, thanks for posting the fix! I was going to roll out 1709 for my new PCs and do a domain migration in the summer away from the single label and then update to 1803 in December but now I guess I'll go full out 1803. We have exchange on site and Microsoft don't support the domain rename with that!

[caffrey]

I'm just having a few problems with sysprep now, there's quite a few issues with that e.g. losing network doing generalize , stuck on "getting ready" (oob stuff) and auto login of the administrator account

 

It's slow tedious work....

[DJ-1701]

Anyone else getting the same selection screens that appear in Windows PE for the build, re-prompt for answers inside Windows?

[caffrey]

I did have that, the thing that worked for me (And something that I forgot) was to create a new capture task sequence using the same wim as the install task sequence (Same windows iso) - cleared a lot of my issues up

[buzzard]

update the deployment share and then update the boot images in WDS, that worked for me especially if you've updated MDT