MCReisinger Posted November 22, 2019 Posted November 22, 2019 Hello, I have created two answer files (pe.xml and postpe.xml). My goal was to have it completely unattended and it is mostly working. The one thing I cannot seem to get to work is that when it automatically logs into the client OS the account it logs in with does not have any local administrator rights. I have tried using Domain Users and Domain Administrators in my .xml file to no avail. I feel I am missing something very basic as I am quite new to this, but I simply cannot narrow it down. Any guidance would be MUCH appreciated.
Duke5A Posted November 26, 2019 Posted November 26, 2019 Domain accounts don't get local administrator rights to a computer unless there is a domain policy object specifying such. By default a newly domain joined computer's object is placed in \ organizational unit. You can't attach policies their in AD anyhow. You would have to change the default location for newly created computer objects another OU with policies attached that grant domain users local admin rights. You shouldn't be using domain accounts anyhow for the auto login step. Use the local administrator account instead to wrap up post-image tasks. Are you rolling your own images are just going right from installation media?
MCReisinger Posted November 26, 2019 Author Posted November 26, 2019 I now understand the flawed thinking of using a domain account, but can I really use the local administrator account for this since it is disabled by default? I am rolling out customized images.
mavhc Posted November 26, 2019 Posted November 26, 2019 Domain Admins should be local admins by default if it's joined the domain correctly. Did it actually join the domain?
free780 Posted November 27, 2019 Posted November 27, 2019 I'd use MDT. WDS is a tool not a solution. You can then specify reboot/shutdown at the end of the task sequence.
MCReisinger Posted November 27, 2019 Author Posted November 27, 2019 Domain Admins should be local admins by default if it's joined the domain correctly. Did it actually join the domain? Yes it successfully joined the domain the the domain admin accounts are local admins. I think maybe I was expecting something that won’t happen until I create local admins via Group Policy?
MCReisinger Posted November 27, 2019 Author Posted November 27, 2019 I'd use MDT. WDS is a tool not a solution. You can then specify reboot/shutdown at the end of the task sequence. The more I have been reading the more I think MDT may be quite helpful. I was holding off as we will soon be using SCCM, but I am going to download MDT and give it a try. Thanks.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now