Sunday, July 11, 2010

Join systems to a remote domain

ISSUE: We have laptops that are brand new & need to be joined to a customer domain.  Instead of bringing them to the office and camping there for hours we found a way to join them to the domain remotely and perform all the necessary work remotely.

SOLUTION:
  1. Log into the PC using a local administrator account. 
  2. VPN into work (using PPTP works best for this).  
  3. While in, join the system to the domain and reboot.  
  4. NOTE: Now here was where it got tricky.  
  5. Log into the PC again using the local administrator account.  
  6. Again, VPN into work.  
  7. Now lock the machine.  
  8. And unlock it using your active directory account.  This will make it hit AD over VPN and confirm and cache your domain account (make sure your AD account is in the Local Administrators group on the local machine).  When you unlock it as a different account, it will typically end your VPN session as it closes the users session.
  9. When the system has logged out, log in using the domain name as a prefix for your user account (eg: fixit.local\steve.adams).  This will work because windows has cached your password hash.

No comments:

Post a Comment