MDT Permission help!!

[Olliedawg]

Banging my head against the wall here!

 

So i have a MDT_User account set up, with full permissions to access the MDT deployment share. If I log into this user, I can fully access the MDT area, even hidden MDT folders.

 

When I run the MDT iso in a HyperV VM & try to log in with the credentials of this MDT User account, i get an error stating I do not have access. Am i missing something stupid here? the MDT user has "Full Control" permissions over the MDT directory/deployment share.

 

Just for testing purposes, i tried the domain admin creds which worked. I have tried changing the UNC path to the IP address instead of the server name, still the same.

 

Any pointers much appreciated!

 

- MDT is on a VM which is domain joined \\****-mdt01

- Created MDT_User account following the guide from Microsoft, with the same OU structure.

[ConTheITGuy]

I had a similar problem, I ended up creating a domain admin account just for MDT

[free780]

Banging my head against the wall here!

 

So i have a MDT_User account set up, with full permissions to access the MDT deployment share. If I log into this user, I can fully access the MDT area, even hidden MDT folders.

 

When I run the MDT iso in a HyperV VM & try to log in with the credentials of this MDT User account, i get an error stating I do not have access. Am i missing something stupid here? the MDT user has "Full Control" permissions over the MDT directory/deployment share.

 

Just for testing purposes, i tried the domain admin creds which worked. I have tried changing the UNC path to the IP address instead of the server name, still the same.

 

Any pointers much appreciated!

 

- MDT is on a VM which is domain joined \\****-mdt01

- Created MDT_User account following the guide from Microsoft, with the same OU structure.

 

Sounds like share permissions aren’t correct. I wouldn’t use a domain admin except for doing work on a domain controller.

[Davit2005]

Sounds like share permissions aren’t correct. I wouldn’t use a domain admin except for doing work on a domain controller.

 

Agreed, use a specific user account with the correct permissions via a group. Should also use a specific non-domain admin account as the account to join the computers to the domain. Delegation can be set on a specific OU then MDT can be setup to use that specific account and deploy new domain joined computers into that specific OU.

 

The less reliance on Domain Admin accounts to do routine tasks or run services the better.

Edited April 25, 2023 by Davit2005

[Olliedawg]

Yea I didn't like the idea of the MDT user having domain admin rights...

 

Still haven't figured out the permissions for the MDT user though. I tried creating a new security group just for the MDT user, and allowing the group full access to the MDT share. Still no joy. I'm no good with powershell either so can't do it that way.

[MartinT]

The thing is, if your Task Sequence is wanting to join a machine to the domain (ours does), then the account will require some domain admin privileges.

[computer_expert]

The thing is, if your Task Sequence is wanting to join a machine to the domain (ours does), then the account will require some domain admin privileges.

 

Not if you delegate permissions to the AD account (or non privileged group) to join the domain. Example, with script here. This script will only help with the permissions for AD domain join account.

 

For the MDT access denied message, you need to verify the user/group has access on both the file/folder permissions AND share permissions for your deployment share. Also if you use the following settings, ensure they are correct in bootstrap.ini:

UserID=
UserPassword=
UserDomain=

PLEASE NOTE - the settings above are stored in plain text on the ISO and in boot.wim

 

I would also try fully regenerating the boot image (there's a check box to force a full rebuild of boot.wim when you update the deployment share) and ensure that the hyper-v vm is pointing to the correct ISO. I've seen force rebuilding the boot image to help with credential issues on the odd occasion.

[Olliedawg]

Not if you delegate permissions to the AD account (or non privileged group) to join the domain. Example, with script here. This script will only help with the permissions for AD domain join account.

 

For the MDT access denied message, you need to verify the user/group has access on both the file/folder permissions AND share permissions for your deployment share. Also if you use the following settings, ensure they are correct in bootstrap.ini:

UserID=
UserPassword=
UserDomain=

PLEASE NOTE - the settings above are stored in plain text on the ISO and in boot.wim

 

I would also try fully regenerating the boot image (there's a check box to force a full rebuild of boot.wim when you update the deployment share) and ensure that the hyper-v vm is pointing to the correct ISO. I've seen force rebuilding the boot image to help with credential issues on the odd occasion.

I'll do some more tinkering tomorrow - determined to get it working!

[ITGURU]

If I recall doesn't the user account used have to be a member of the local administrators group on the deployment server?

[Davit2005]

You can jus create an OU and delegate only the required permissions to an account to be able to create computer objects etc. It is documented somewhere.

 

I've seen such an account that had domain admin compromised, it is jus another potential risk and bad practice.

 

Below is a link to a guide but it might not necessarily be the one I used as I done this around 7 to 8 years back.

 

https://www.moderndeployment.com/correct-domain-join-account-permissions/

Edited April 27, 2023 by Davit2005

[Olliedawg]

Sorted!!! Got the MDT user working without admin privileges. Did a deep dive of permissions on the D:\ drive which contains the MDTBuild & also completely regenerated the deployment .wim

[Olliedawg]

Reviving this thread - has anybody else encountered MDT not capturing the image to the MDT share after sysprep? All of my settings look to be correct - as in both the Rules tab for the deployment share & the task sequence being set to capture at the end of the sequence. I have gone over these & made sure all correct, regenerated the .iso file afterwards.

 

This is my process

 

- Launch HyperV VM with the Default image.iso from MDT Server

- Specify to capture an image to my MDT share \\**.**.**.**\Data\MDTShare\Captures

- Wait for MDT to complete the image process/task sequence. Finishes with no errors at all at any point in the process.

 

Once done, my captures folder on the share is empty. Anyone have any ideas?