Domain Join problems since October 2022 update

[psydii]

If you suddenly start seeing unexpected behaviour when imaging/re-imaging computers on a domain, the changes in October 2022's updates may be the cause.

 

(also, unrelated, file copy via group policy preferences is broken in common scenarios - a work around is given in the security update web page)

 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38042

https://support.microsoft.com/en-gb/topic/october-11-2022-kb5018421-os-build-20348-1129-115b1147-9568-4924-83b8-d27ab5b495be

https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8

[jslate1980]

Luckily for us the windows updates for an image are not installed until after the domain join process.

[ITGuyNW]

Could this be related? KB5020276—Netjoin: Domain join hardening changes (microsoft.com)

[mavhc]

If you've limited who can join a computer to the domain, would that stop the problem?

[jslate1980]

Yes, After October patches are applied to a client, you cannot join the domain to an existing computer object if you are either not a Domain Admin or the owner of the AD object.

 

The scenario of re-images where a service account is doing the domain join and someone used a personal account to pre-stage the AD object completely breaks.

 

 

https://borncity.com/win/2022/10/12/windows-oktober-2022-patchday-fix-fr-domain-join-hardening-cve-2022-38042-verhindert-ggf-domain-join/

Edited October 14, 2022 by jslate1980

[PurpleTentacle]

We're seeing an interesting issue, after applying KB5018421 a domain joined computer cannot be renamed.

Removing the update allows the machine to be renamed.

It mentions an eventlog, but which one I do not know. It's not SYSTEM, AAD, or PowerShell.

 

 

 

PS C:\windows\system32> Rename-Computer -NewName F57-0 -Restart

Rename-Computer : Fail to rename computer 'TEND45D648129B2' to 'F57-0' due to the following exception: Unable to update hostname in Azure AD. Check the event log for detailed error information.

At line:1 char:1

+ Rename-Computer -NewName F57-0 -Restart

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : OperationStopped: (TEND45D648129B2:String) [Rename-Computer], InvalidOperationException

+ FullyQualifiedErrorId : FailToRenameComputer,Microsoft.PowerShell.Commands.RenameComputerCommand

[kevin_lane]

Have you seen this don’t know if it will help

 

https://learn.microsoft.com/en-us/answers/questions/136649/domain-computer-hybrid-joined-renaming-not-work.html

[PurpleTentacle]

That does work - thank you. I hadn't come across the dsregcmd previously, so I've got a new toy.

[PurpleTentacle]

The issue appears to be somewhere between our Internet filtering solution and the October KB5018421. Removing the update fixes the issue, as does leaving the update in place and removing the filtering software.