Offline Domain Join

%3CLINGO-SUB%20id%3D%22lingo-sub-1772541%22%20slang%3D%22en-US%22%3EOffline%20Domain%20Join%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1772541%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20testing%20the%20of%20Offline%20Domain%20Join%20using%20DirectAccess%2C%20our%20testing%20includes%20two%20use%20cases%2C%20DJOIN%20with%20Certificate%20and%20DJOIN%20Without%20Certificate.%20We%20would%20like%20to%20use%20this%20process%20to%20rejoin%20AD%20Orphan%20workstations%20of%20users%20that%20are%20at%20home%20and%20that%20do%20not%20VPN%20to%20the%20corporate%20network%20and%20have%20them%20connect%20trough%20DirectAccess.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDJOIN%20with%20Certificate%3CBR%20%2F%3EDJOIN%20Command%20Syntax%3A%20%E2%80%9CDJOIN%20%2Fprovision%20%2Fmachine%20COMPUTERNAME%20%2Fdomain%20DOMAINNAME%20%2Fpolicynames%20%22DirectAccess%20Client%20Settings%22%20%2Fcerttemplate%20CATEMPLATENAME%20%2Fsavefile%20c%3A%5Cfiles%5Cprovision.txt%20%2Freuse%E2%80%9D%3CBR%20%2F%3EThis%20command%20is%20erroring%20out%20saying%20that%20CA%20Template%20is%20not%20supported.%20Our%20PKI%20environment%20is%20a%20Symantec%20PKI%20solution%20that%20the%20Root%20CA%20is%20cloud%20hosted%20with%20issuing%20servers%20on%20corporate%20network.%20Certificates%20are%20previsioned%20based%20on%20the%20workstation%20being%20member%20of%20an%20AD%20group%20and%20the%20uses%20of%20a%20GPO.%20The%20DJOIN%20command%20does%20not%20create%20a%20Blob%20text%20files.%3CBR%20%2F%3EThe%20test%20workstation%20is%20a%20member%20of%20the%20PKI%20and%20DirectAccess%20Global%20Security%20group.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDJOIN%20Without%20Certificate%3CBR%20%2F%3EDJOIN%20Command%20Syntax%3A%20%E2%80%9CDJOIN%20%2Fprovision%20%2Fmachine%20COMPUTERNAME%20%2Fdomain%20DOMAINNAME%20%2Fpolicynames%20%22DirectAccess%20Client%20Settings%22%20%2Fsavefile%20c%3A%5Cfiles%5Cprovision.txt%20%2Freuse%E2%80%9D%3CBR%20%2F%3EWhen%20we%20run%20the%20command%20it%20create%20the%20Blob%20text%20file%20successfully%2C%20we%20move%20the%20file%20to%20the%20workstation%20and%20then%20unjoin%20the%20workstation%20from%20the%20domain%20by%20moving%20the%20computer%20to%20a%20WORKGROUP.%20After%20the%20computer%20reboots%2C%20we%20login%20to%20the%20computer%20with%20an%20account%20that%20has%20admin%20access.%20Next%20we%20run%20the%20command%20%E2%80%9CDJOIN%20%2Frequestodj%20%2Floadfile%20C%3A%5CFiles%5Cprovision.txt%20%2Fwindowspath%20%25windir%25%20%2Flocalos%E2%80%9D.%20The%20command%20completes%20successfully%20and%20we%20are%20prompting%20to%20reboot%20the%20computer.%20After%20the%20computer%20reboots%20we%20try%20to%20login%20with%20a%20AD%20domain%20account%20which%20fails%20after%20some%20time%20indicating%20that%20there%20is%20no%20trust%20with%20the%20workstation.%20The%20test%20workstation%20is%20hardwired%20connect%20to%20the%20network.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20case%20open%20with%20Microsoft%20and%20they%20are%20researching%26nbsp%3B%20it.%3C%2FP%3E%3CP%3EThanks%20for%20any%20help%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1849618%22%20slang%3D%22en-US%22%3ERe%3A%20Offline%20Domain%20Join%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1849618%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F829269%22%20target%3D%22_blank%22%3E%40Lawrence_Tobin%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMicrosoft%20Support%20would%20be%20able%20to%20help%20you%2C%20since%20they%20will%20check%20you%20log%20files%20and%20directly%20work%20with%20you.%20Using%20DirectAccess%20without%20Certificate%20is%20unsupported%20scenario%20and%20most%20likely%20it%20will%20fail%20to%20work.%3C%2FP%3E%3CP%3EYou%20may%20also%20check%20out%20these%20steps%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-server%2Fremote%2Fremote-access%2Fdirectaccess%2Fadd-to-existing-vpn%2Fenable-directaccess%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows-server%2Fremote%2Fremote-access%2Fdirectaccess%2Fadd-to-existing-vpn%2Fenable-directaccess%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Visitor

We are testing the of Offline Domain Join using DirectAccess, our testing includes two use cases, DJOIN with Certificate and DJOIN Without Certificate. We would like to use this process to rejoin AD Orphan workstations of users that are at home and that do not VPN to the corporate network and have them connect trough DirectAccess.

 

DJOIN with Certificate
DJOIN Command Syntax: “DJOIN /provision /machine COMPUTERNAME /domain DOMAINNAME /policynames "DirectAccess Client Settings" /certtemplate CATEMPLATENAME /savefile c:\files\provision.txt /reuse”
This command is erroring out saying that CA Template is not supported. Our PKI environment is a Symantec PKI solution that the Root CA is cloud hosted with issuing servers on corporate network. Certificates are previsioned based on the workstation being member of an AD group and the uses of a GPO. The DJOIN command does not create a Blob text files.
The test workstation is a member of the PKI and DirectAccess Global Security group.

 

DJOIN Without Certificate
DJOIN Command Syntax: “DJOIN /provision /machine COMPUTERNAME /domain DOMAINNAME /policynames "DirectAccess Client Settings" /savefile c:\files\provision.txt /reuse”
When we run the command it create the Blob text file successfully, we move the file to the workstation and then unjoin the workstation from the domain by moving the computer to a WORKGROUP. After the computer reboots, we login to the computer with an account that has admin access. Next we run the command “DJOIN /requestodj /loadfile C:\Files\provision.txt /windowspath %windir% /localos”. The command completes successfully and we are prompting to reboot the computer. After the computer reboots we try to login with a AD domain account which fails after some time indicating that there is no trust with the workstation. The test workstation is hardwired connect to the network.

 

We have a case open with Microsoft and they are researching  it.

Thanks for any help

2 Replies

@Lawrence_Tobin 

Microsoft Support would be able to help you, since they will check you log files and directly work with you. Using DirectAccess without Certificate is unsupported scenario and most likely it will fail to work.

You may also check out these steps:

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/directaccess/add-to-existing-vp... 

 

First thing Microsoft or Anyone would need to have the logs for that particular workstation from the remote access server. Then, they can troubleshoot it.