Forum Discussion

Azteams722's avatar
Azteams722
Copper Contributor
Oct 07, 2023

Domain join not working via custom extension via Terraform

Getting error when trying to domain join an Azure VM via terraform code with a custom VM extension script:

resource "azurerm_virtual_machine_extension" "domain_join" {
  name                       = "${var.prefix}-domainJoin"
  virtual_machine_id         = azurerm_windows_virtual_machine.vd_vm.id
  publisher                  = "Microsoft.Compute"
  type                       = "JsonADDomainExtension"
  type_handler_version       = "1.3"
  auto_upgrade_minor_version = true

  settings = <<SETTINGS
    {
     
      "Name": "test.onmicrosoft.com",
      "OUPath": "",
      "User": "test.onmicrosoft\\adminuser",
      "Restart": "true",
      "Options": "3"
    }
SETTINGS

  protected_settings = <<PROTECTED_SETTINGS
    {
      "Password": "${var.domain_password}"
    }
PROTECTED_SETTINGS

  lifecycle {
    ignore_changes = [settings, protected_settings]
  }
}

Error code for domain join for Azure VM is failing via terraform code:

Error: Code="VMExtensionProvisioningError" Message="VM has reported a failure when processing extension 'vm-domainJoin' (publisher 'Microsoft.Compute' and type 'JsonADDomainExtension'). Error message: \"Exception(s) occurred while joining Domain 'techvaluator.onmicrosoft.com'\". More information on troubleshooting is available at https://aka.ms/vmextensionwindowstroubleshoot. "
│
│ with azurerm_virtual_machine_extension.domain_join,
│ on host.tf line 68, in resource "azurerm_virtual_machine_extension" "domain_join":
│ 68: resource "azurerm_virtual_machine_extension" "domain_join" {

 

+ It always fails with below error:
+ All Infra is on Azure only.
+ Let's say Domain controller IP is 10.10.0.5, AD DS is "feedback.onmicrosoft.com" synced successfully.
+ VM in same VNET is also not able to do the domain join.
+ Domain in Controller is configured as feedback.onmicrosoft.com
+ DNS is configured as well.
+ Via Terraform code, VMs are configured successfully with all attributes but domain join extension provisioning fails. I can see the extension in GUI under the VM extensions though.
+ Manual domain join works.
+ VM has correct DNS servers i.e. 10.10.0.4, 10.10.0.6 as per ADDS sync message. added 10.10.0.5 which is configured on Az DC VM

Any suggestions what to check to fix this issue and let any new VM join the domain?

Thanks!
TV

+ Code seems ok.
+ Verified the attributes in DC.
+ Manual domain join works.

+ Code seems ok.

+ Verified the attributes in DC.
+ Manual domain join works.

Any suggestions to get it fixed? 

Resources