diff --git a/.gitbook/assets/foundry-deploy-domain-join-01-interactive-ou.png b/.gitbook/assets/foundry-deploy-domain-join-01-interactive-ou.png new file mode 100644 index 0000000..d482401 Binary files /dev/null and b/.gitbook/assets/foundry-deploy-domain-join-01-interactive-ou.png differ diff --git a/.gitbook/assets/foundry-deploy-domain-join-02-zero-touch-ou.png b/.gitbook/assets/foundry-deploy-domain-join-02-zero-touch-ou.png new file mode 100644 index 0000000..d3b586f Binary files /dev/null and b/.gitbook/assets/foundry-deploy-domain-join-02-zero-touch-ou.png differ diff --git a/.gitbook/assets/foundry-osd-domain-join-01-overview-empty.png b/.gitbook/assets/foundry-osd-domain-join-01-overview-empty.png new file mode 100644 index 0000000..aa8a471 Binary files /dev/null and b/.gitbook/assets/foundry-osd-domain-join-01-overview-empty.png differ diff --git a/.gitbook/assets/foundry-osd-domain-join-interactive-01-configuration.png b/.gitbook/assets/foundry-osd-domain-join-interactive-01-configuration.png new file mode 100644 index 0000000..8a05b01 Binary files /dev/null and b/.gitbook/assets/foundry-osd-domain-join-interactive-01-configuration.png differ diff --git a/.gitbook/assets/foundry-osd-domain-join-zero-touch-01-readiness.png b/.gitbook/assets/foundry-osd-domain-join-zero-touch-01-readiness.png new file mode 100644 index 0000000..ed2d721 Binary files /dev/null and b/.gitbook/assets/foundry-osd-domain-join-zero-touch-01-readiness.png differ diff --git a/SUMMARY.md b/SUMMARY.md index 50a8ab7..d7fbefa 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -17,6 +17,9 @@ * [JSON profile](foundry-osd/autopilot/json-profile.md) * [Zero-touch hardware hash upload](foundry-osd/autopilot/zero-touch-hardware-hash.md) * [Interactive hardware hash upload](foundry-osd/autopilot/interactive-hardware-hash.md) + * [Domain Join](foundry-osd/domain-join/README.md) + * [Zero-touch Domain Join](foundry-osd/domain-join/zero-touch.md) + * [Interactive Domain Join](foundry-osd/domain-join/interactive.md) * [Windows customization](foundry-osd/customization/README.md) * [Operating system](foundry-osd/customization/operating-system.md) * [Custom Windows images](foundry-osd/customization/custom-windows-images.md) @@ -40,12 +43,14 @@ * [Select the target](foundry-deploy/target.md) * [Select Windows](foundry-deploy/operating-system.md) * [Select a driver pack](foundry-deploy/driver-pack.md) + * [Domain Join](foundry-deploy/domain-join.md) * [Review and deploy](foundry-deploy/review-and-deploy.md) * [Verify deployment](foundry-deploy/verify-deployment.md) * [Troubleshooting](troubleshooting/README.md) * [Media creation](troubleshooting/media-creation.md) * [Network and Foundry Connect](troubleshooting/network.md) * [Windows deployment](troubleshooting/deployment.md) + * [Domain Join](troubleshooting/domain-join.md) * [Windows Autopilot](troubleshooting/autopilot.md) * [Logs and support information](troubleshooting/logs-and-support.md) * [Reference](reference/README.md) diff --git a/foundry-deploy/README.md b/foundry-deploy/README.md index caaff8a..eb2bcff 100644 --- a/foundry-deploy/README.md +++ b/foundry-deploy/README.md @@ -7,13 +7,16 @@ Foundry Deploy runs in Windows PE after network readiness. It guides a technicia - Confirm that the device is connected to power. - Confirm that required network services are reachable. - Disconnect storage devices that must not be selected accidentally. -- Obtain the technician password when Protected deployment is enabled. +- Obtain the technician password when Password protection is enabled. +- For [Domain Join](domain-join.md), have the join account and its password ready when the media is Interactive, and make sure the computer will reach the domain once Windows is installed. {% hint style="danger" %} Deployment erases and repartitions the selected target disk. Verify the target before starting. {% endhint %} -When Protected deployment is enabled, Foundry Deploy requests the technician password before initialization. Cancelling the prompt closes Foundry Deploy. Incorrect attempts can be retried, with a progressively longer delay of up to five seconds. If the password is lost, recreate the media in Foundry OSD. +When Password protection is enabled, Foundry Deploy requests the technician password before initialization. Cancelling the prompt closes Foundry Deploy. Incorrect attempts can be retried, with a progressively longer delay of up to five seconds. If the password is lost, recreate the media in Foundry OSD. + +Zero-touch Domain Join uses the same technician password; there is no separate prompt for the domain account. Interactive Domain Join does not require Password protection. {% hint style="info" %} Foundry Deploy validates HTTPS server certificates. When the catalog supplies a file hash, Deploy checks downloaded files and rechecks cached files before reuse. For cached Windows images and OEM driver packs, **Checking cache...** shows the verification percentage and bytes processed. Allow extra time when using large files or slower USB drives. A cached file that fails verification is downloaded again with its own download progress; a replacement that also fails verification stops the affected step. See [download troubleshooting](../troubleshooting/deployment.md#download-fails). @@ -27,5 +30,6 @@ Keep deployment media under your control. Packages without a catalog hash retain 2. [Select Windows](operating-system.md). 3. [Select a driver pack](driver-pack.md). 4. Configure Windows Autopilot when JSON profile or zero-touch upload media requires a deployment-time choice. Interactive upload runs later during Windows OOBE and does not add this wizard step. -5. [Review and deploy](review-and-deploy.md). -6. [Verify deployment](verify-deployment.md). +5. Complete the [Domain join step](domain-join.md#complete-the-domain-join-step) when the wizard shows it. It appears before the summary when there is a domain account to enter, or a domain or an OU to choose. +6. [Review and deploy](review-and-deploy.md). +7. [Verify deployment](verify-deployment.md). diff --git a/foundry-deploy/domain-join.md b/foundry-deploy/domain-join.md new file mode 100644 index 0000000..e7c0333 --- /dev/null +++ b/foundry-deploy/domain-join.md @@ -0,0 +1,97 @@ +# Domain Join during deployment + +This page is for the technician who deploys a computer with media configured for [Interactive](../foundry-osd/domain-join/interactive.md) or [Zero-touch](../foundry-osd/domain-join/zero-touch.md) Domain Join. + +The wizard only collects what the join needs. The join itself runs later, in installed Windows, and needs the domain to be reachable at that moment. + +## Before you start + +- Know which domain and OU the computer belongs to, and its computer name. For Interactive media, also have the join account and its password. +- Confirm the [target disk and computer name](target.md). The computer name identifies the computer account in the domain, so check it carefully when a machine is redeployed under the same name. +- Select the intended Windows image and edition. Windows Home editions cannot join a domain: the wizard skips the step and the summary says so, while the installation continues. + +## Complete the Domain join step + +The **Domain join** step sits between **Drivers** and **Summary**. It appears only when there is something to enter or choose, and **Next** stays unavailable until the entries are valid. + +**Domain name** + +| Media | What you do | +| --- | --- | +| Several domains listed | Choose the domain. The default is preselected. | +| One domain listed | Nothing. The domain is shown and cannot be changed. | +| Interactive media with no domain listed | Type the domain name, such as `corp.contoso.com`. | + +**Account and password** + +| Media | What you do | +| --- | --- | +| Interactive | Enter the **Account**, as `DOMAIN\user` or `user@domain`, and its **Password**. Changing the domain keeps what you typed. | +| Zero-touch | Nothing. The media carries the account, unlocked by the technician password you entered at startup. | + +**Organizational unit** + +| OUs listed for the chosen domain | What you do | +| --- | --- | +| Several | Choose the **Organizational unit**. The default, if there is one, is preselected; **Next** requires a choice. | +| One | Nothing. That OU is used. | +| None, Interactive media | Optionally enter **OU distinguished name (optional)**, starting with `OU=` and inside that domain. Leave it empty to use the domain's default location. | +| None, Zero-touch media | Nothing. The domain's default location is used. | + +Changing the domain replaces the OU choices with those of the new domain. + +{% hint style="info" %} +The wizard does not contact the domain. A mistyped account or password is accepted here and only shows later, in installed Windows, as a failed join. +{% endhint %} + +
+ Domain join step of Foundry Deploy on Interactive media with the domain list, empty account and password fields and the OU list +
Interactive media: choose the domain, enter the join account and its password, then choose the OU.
+
+ +
+ Domain join step of Foundry Deploy on Zero-touch media with the domain list and the OU list only +
Zero-touch media: only the domain and the OU are left to choose.
+
+ +## Review and start + +On **Summary**, the **Domain join** category shows the domain and the OU the join will use; choose its edit action to return to the step. The account and the password are never shown, neither here nor in **Confirm disk erase**. + +When the deployment ends successfully in WinPE, the join has been prepared, not yet performed. + +## What happens in Windows + +After the restart, during Windows setup and before the first sign-in, a Foundry console shows the post-installation actions. The join runs after drivers and network settings are applied: + +1. Foundry waits until a domain controller answers, for up to two minutes. +2. It joins the computer to the domain with the join account. A refused account or password is not retried, so the account cannot be locked out. +3. If an OU applies, the computer account is created in that OU. An account that already exists under the same name is reused and moved to the OU, without being deleted. +4. When the join succeeds, Windows restarts once. Foundry then checks that the computer is a member of the expected domain under the expected name. + +The console summarizes the outcome on one line, for example: + +`Domain - Join: Succeeded; Placement: Succeeded; Membership: Succeeded; Restart: Completed; Cleanup: Disposed` + +| Part | Meaning | +| --- | --- | +| Join | The computer was added to the domain. | +| Placement | The computer account is in the intended OU. **Skipped** when no OU applies. | +| Membership | After the restart, Windows confirms it belongs to the expected domain. | +| Restart | The restart required by the join. | +| Cleanup | The temporary copy of the join credentials was deleted (**Disposed**). | + +A failed join or placement does not stop the installation: the remaining actions run and Windows setup continues. + +## What you see at the end + +| Outcome | First screen | +| --- | --- | +| The join is confirmed | The Windows sign-in screen. Sign in with a domain account. No local account is needed; add one on the [OOBE page](../foundry-osd/customization/oobe.md) of Foundry OSD if you want local access. | +| The join failed or could not be confirmed | Windows asks **Who's going to use this device?** Create a local account to reach the desktop, then see [Domain Join troubleshooting](../troubleshooting/domain-join.md). | + +With a [custom answer file](../foundry-osd/customization/unattend.md), that file decides which setup screens and accounts appear; Foundry does not change them. + +## Before handing over the computer + +Check [deployment verification](verify-deployment.md#domain-join): sign in with a domain account, and confirm with your Active Directory administrator that the computer account is in the intended OU. If the console reported anything other than **Succeeded** for the join, the placement or the membership, see [Domain Join troubleshooting](../troubleshooting/domain-join.md). diff --git a/foundry-deploy/review-and-deploy.md b/foundry-deploy/review-and-deploy.md index ace5396..04696f3 100644 --- a/foundry-deploy/review-and-deploy.md +++ b/foundry-deploy/review-and-deploy.md @@ -11,6 +11,7 @@ Confirm: - Driver pack. - Firmware options. - Windows Autopilot method and, for zero-touch hardware hash upload, the configured group tag. +- Domain Join: the domain and the OU the computer will join. - Optional features and other deployment customization.
@@ -24,6 +25,8 @@ When the media includes [custom answer files](../foundry-osd/customization/unatt Start only when every value is correct. Foundry opens **Confirm disk erase** before crossing the destructive boundary. Verify the disk number, model, bus, size, and selected operating system before accepting. +The [Domain join step](domain-join.md#complete-the-domain-join-step) comes before the summary. The summary's **Domain join** category shows the domain and the OU the join will use, or says that the selected Windows edition cannot join a domain. The account and the password are never shown. + {% hint style="danger" %} Accepting the confirmation allows Foundry to clean and repartition the selected disk. Existing data on that disk will be lost. {% endhint %} @@ -76,3 +79,5 @@ For [custom images](../foundry-osd/customization/custom-windows-images.md), veri ## Post-installation preparation Foundry checks required [Post-installation](../foundry-osd/customization/post-installation.md) content and its runtime before preparing the target disk. When actions use imported scripts or packages, keep the complete ISO or USB media available until staging finishes. If this check fails, see [Post-installation preparation fails](../troubleshooting/deployment.md#post-installation-preparation-fails). Successful staging does not prove first-boot actions succeeded; continue through [deployment verification](verify-deployment.md). + +For Domain Join, a successful deployment means the join has been prepared; it runs after the restart, in installed Windows. When the Windows edition or the image is not compatible, Foundry skips the join with a warning in the summary and the installation continues. Check the outcome as described in [Domain Join during deployment](domain-join.md#what-happens-in-windows). diff --git a/foundry-deploy/target.md b/foundry-deploy/target.md index e761aaf..ae074bc 100644 --- a/foundry-deploy/target.md +++ b/foundry-deploy/target.md @@ -12,6 +12,8 @@ When the media enables custom answer files, choose one in **Answer file** or sel Review the selected file in the summary and confirmation. Missing files, an invalid default, architecture mismatches, and known Autopilot conflicts can block deployment. Foundry does not silently switch to native settings. See [custom answer-file preparation and compatibility](../foundry-osd/customization/unattend.md). +For [Domain Join](domain-join.md) with a custom answer file, the file must set exactly one fixed computer name in its `specialize` pass and must not contain a `Microsoft-Windows-UnattendedJoin` component. Foundry uses the name from the file and does not replace a missing or `*` name with the one shown in the wizard. Correct the file before starting. + ## Set the computer name The following naming rules apply when using native Foundry settings. diff --git a/foundry-deploy/verify-deployment.md b/foundry-deploy/verify-deployment.md index 8150817..a760525 100644 --- a/foundry-deploy/verify-deployment.md +++ b/foundry-deploy/verify-deployment.md @@ -36,6 +36,12 @@ When using [Post-installation](../foundry-osd/customization/post-installation.md Verify that the installed applications work after cleanup. If they need source files for repair or updates, confirm that those files remain available. Keep the [PostInstall results and logs](../troubleshooting/logs-and-support.md#postinstall-diagnostics) when investigating a problem. +## Domain Join + +A successful deployment only means the join was prepared. After the restart, check the line that starts with `Domain -` in the Foundry console, then sign in with a domain account. Being a member of the domain does not prove that the computer account is in the intended OU: confirm it with your Active Directory administrator. + +When the join, the placement or the membership is not **Succeeded**, or when **Cleanup** stays **Pending**, resolve it before handing over the computer; see [Domain Join troubleshooting](../troubleshooting/domain-join.md). If Deploy skipped the join because of the Windows edition or the image, only the deployment summary mentions it. + ## Automatic Windows activation For standard RETAIL deployments of supported Windows Home and Pro editions, Foundry automatically attempts to activate Windows after reboot using a compatible OEM product key stored in the device firmware. Online activation requires Internet access and a valid key for the installed Windows edition. diff --git a/foundry-osd/README.md b/foundry-osd/README.md index 1dc4cf1..5f67dfc 100644 --- a/foundry-osd/README.md +++ b/foundry-osd/README.md @@ -7,7 +7,7 @@ Foundry OSD is the Windows desktop application used to prepare deployment media. 1. Validate [Windows ADK and Windows PE](adk.md). 2. Review [general configuration](general.md). 3. Configure [network access](network/README.md) when required. -4. Choose a [Windows Autopilot](autopilot/README.md) method when required. +4. Choose a [Windows Autopilot](autopilot/README.md) method or [Domain Join](domain-join/README.md) when required. Only one provisioning mode can be active. 5. Select [Windows customization](customization/README.md) options. 6. [Create deployment media](media/README.md). diff --git a/foundry-osd/autopilot/README.md b/foundry-osd/autopilot/README.md index 42b8193..d1247b9 100644 --- a/foundry-osd/autopilot/README.md +++ b/foundry-osd/autopilot/README.md @@ -2,6 +2,8 @@ Foundry supports three Autopilot workflows. Choose the method that matches the organization’s provisioning and security model. +[Domain Join](../domain-join/README.md) is the alternative to Windows Autopilot. Enabling it replaces the active Autopilot mode, and enabling an Autopilot mode replaces Domain Join; Foundry asks for confirmation. Create the media again after switching. + ## Choose a method ### JSON profile diff --git a/foundry-osd/autopilot/json-profile.md b/foundry-osd/autopilot/json-profile.md index a446e08..9f3bf53 100644 --- a/foundry-osd/autopilot/json-profile.md +++ b/foundry-osd/autopilot/json-profile.md @@ -19,12 +19,12 @@ All profiles retained in Foundry OSD are included in media created for the JSON ## Protect the profile on deployment media -Enable **Protected deployment** from [General configuration](../general.md) before creating the media when the retained Autopilot profiles must not remain readable on the ISO or USB drive. +Enable **Password protection** from [General configuration](../general.md) before creating the media when the retained Autopilot profiles must not remain readable on the ISO or USB drive. When protection is enabled, Foundry stores every retained profile on the deployment media using AES-256-GCM encryption. Readable JSON files are not stored alongside the encrypted profiles. Foundry Deploy asks for the technician password, unlocks the deployment key, and decrypts the selected profile before staging it in the Windows installation. {% hint style="warning" %} -Without Protected deployment, every retained Autopilot JSON profile is stored in readable form on the deployment media. Restrict access to the ISO or USB drive and recreate the media if it is lost or copied without authorization. +Without Password protection, every retained Autopilot JSON profile is stored in readable form on the deployment media. Restrict access to the ISO or USB drive and recreate the media if it is lost or copied without authorization. {% endhint %} ## Expected result diff --git a/foundry-osd/autopilot/zero-touch-hardware-hash.md b/foundry-osd/autopilot/zero-touch-hardware-hash.md index 8c5a641..6dc11f1 100644 --- a/foundry-osd/autopilot/zero-touch-hardware-hash.md +++ b/foundry-osd/autopilot/zero-touch-hardware-hash.md @@ -88,9 +88,9 @@ Use a dedicated application registration for Foundry deployment media. Do not re Foundry places the certificate PFX and its PFX password in the deployment configuration. Both values are encrypted with AES-256-GCM, which also detects whether the encrypted data has been modified. -Enable **Protected deployment** from [General configuration](../general.md) before creating the media. +Enable **Password protection** from [General configuration](../general.md) before creating the media. -Foundry generates a random 256-bit deployment key for each media-creation operation. When Protected deployment is enabled: +Foundry generates a random 256-bit deployment key for each media-creation operation. When Password protection is enabled: 1. Foundry derives a key from the deployment password using PBKDF2-HMAC-SHA-256, 600,000 iterations, and a random 128-bit salt. 2. The password-derived key protects the random deployment key with AES-256-GCM. @@ -102,10 +102,10 @@ AES-GCM uses a unique 96-bit nonce and a 128-bit authentication tag for each enc A copied ISO or USB drive therefore cannot reveal the PFX private key through the stored deployment key alone; the deployment password must also be obtained or recovered. This protection no longer applies after an authorized technician unlocks the media and Foundry Deploy starts using the credential. {% hint style="warning" %} -Protected deployment does not encrypt the entire ISO, USB drive, or Windows installation content. It protects access to Foundry Deploy and the deployment secrets stored in its configuration. +Password protection does not encrypt the entire ISO, USB drive, or Windows installation content. It protects access to Foundry Deploy and the deployment secrets stored in its configuration. {% endhint %} -If Protected deployment is disabled, the PFX and its password remain encrypted, but the deployment key is stored on the media so that deployment can start without a password. Anyone who obtains the media must therefore be treated as having access to its embedded deployment credentials. +If Password protection is disabled, the PFX and its password remain encrypted, but the deployment key is stored on the media so that deployment can start without a password. Anyone who obtains the media must therefore be treated as having access to its embedded deployment credentials. Use a unique password of at least 12 characters for deployment media. Foundry accepts passwords from 8 characters, but warns when fewer than 12 characters are used. The password is not stored on the media. If it is lost, recreate the media. diff --git a/foundry-osd/customization/machine-naming.md b/foundry-osd/customization/machine-naming.md index 8901374..5baf6b3 100644 --- a/foundry-osd/customization/machine-naming.md +++ b/foundry-osd/customization/machine-naming.md @@ -63,6 +63,12 @@ If a composed name cannot be generated because a required hardware value is unav The preview uses representative values. Foundry Deploy resolves actual hardware values at deployment startup and applies casing and separators to the same component rules used in the preview. For random text, a random value is generated with the configured length during deployment startup. +## Domain Join + +[Domain Join](../domain-join/README.md) uses the computer name to find or create the computer account in the domain. Check it before confirming the disk erase, especially when a machine is redeployed under an existing name. + +With a [custom answer file](unattend.md), the name comes from the file: it must set exactly one fixed computer name in the `specialize` pass of `Microsoft-Windows-Shell-Setup`. A missing name, a `*` wildcard or several names are refused, and the naming rules on this page do not apply. + ## Upload the computer name to Autopilot Enable **Upload computer name to Autopilot** to assign the final computer name confirmed in Foundry Deploy to the Windows Autopilot device record. This works with both **Manual** and **Composed** naming, including any changes made by the deployment operator. The uploaded value is the same final name used for Windows setup; the Foundry OSD preview and initial value are not uploaded separately. diff --git a/foundry-osd/customization/oobe.md b/foundry-osd/customization/oobe.md index 4f80ce9..fe3065f 100644 --- a/foundry-osd/customization/oobe.md +++ b/foundry-osd/customization/oobe.md @@ -61,14 +61,14 @@ Foundry does not configure AutoLogon and does not request account passwords duri ## Password protection -Non-empty local account passwords require [Protected deployment](../general.md#protected-deployment). This is a Foundry security requirement, not a Windows Setup requirement. Foundry keeps authoring passwords only for the current session and encrypts them in the deployment configuration written to the media. +Non-empty local account passwords require [Password protection](../general.md#password-protection). This is a Foundry security requirement, not a Windows Setup requirement. Foundry keeps authoring passwords only for the current session and encrypts them in the deployment configuration written to the media. During deployment, Foundry decrypts the passwords for Windows Setup and writes them to `unattend.xml` using reversible encoding with `PlainText=false`. This hides the values but does not encrypt them. Treat answer files and their copies as sensitive data; media protection does not provide end-to-end encryption of the Windows Setup answer file. See [Microsoft's guidance on hidden answer-file passwords](https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/wsim/hide-sensitive-data-in-an-answer-file). -If a predefined account password is enabled while Protected deployment is disabled, Foundry blocks media creation and marks both **OOBE** and **Password protection** as needing attention. Enable Protected deployment and configure its technician password, or turn off the predefined account password to use an intentional blank password. +If a predefined account password is enabled while Password protection is disabled, Foundry blocks media creation and marks both **OOBE** and **Password protection** as needing attention. Enable Password protection and configure its technician password, or turn off the predefined account password to use an intentional blank password. Foundry saves whether each account requires a predefined password, but it never saves the password itself in the authoring configuration. After restarting Foundry OSD, re-enter and confirm every required account password before creating deployment media. Foundry marks the OOBE configuration as needing attention until those passwords are available again. The **Accounts** header shows **Needs attention** even when collapsed if an account setting is invalid, a required password is missing, or deployment protection is required. Autopilot only causes this attention indicator when additional local accounts are also configured. The Standard-only warning is advisory and does not block media creation. -Blank passwords do not require Protected deployment because no password secret is stored. Apply the organization's password and device-access policies before using this option. +Blank passwords do not require Password protection because no password secret is stored. Apply the organization's password and device-access policies before using this option. diff --git a/foundry-osd/customization/post-installation.md b/foundry-osd/customization/post-installation.md index d11fe4f..1352c5c 100644 --- a/foundry-osd/customization/post-installation.md +++ b/foundry-osd/customization/post-installation.md @@ -44,14 +44,17 @@ After the first boot into installed Windows, Foundry runs the following before O | --- | --- | | 1 | Install deferred driver packages, such as supported Lenovo EXE and Surface MSI packages. Drivers injected offline are already installed during deployment. | | 2 | Import configured certificates and wired/Wi-Fi profiles. | -| 3 | Remove selected Copilot and AI Hub application packages. Other AI settings may already have been applied during deployment. | -| 4 | Remove the selected provisioned AppX packages. | -| 5 | Attempt OEM activation when eligible. This is skipped for custom answer files and volume-licensed deployments. | -| 6 | Run your enabled custom actions in the order shown, including any Restart Windows actions. | -| 7 | Perform cleanup of temporary deployment content, retaining execution results and logs. | +| 3 | Domain Join: join the domain and place the computer in its OU, restart Windows once when the join succeeded, then check that the computer is a member of the domain. | +| 4 | Remove selected Copilot and AI Hub application packages. Other AI settings may already have been applied during deployment. | +| 5 | Remove the selected provisioned AppX packages. | +| 6 | Attempt OEM activation when eligible. This is skipped for custom answer files and volume-licensed deployments. | +| 7 | Run your enabled custom actions in the order shown, including any Restart Windows actions. | +| 8 | Perform cleanup of temporary deployment content, retaining execution results and logs. | Required restarts can occur during this sequence. A planned restart resumes the remaining work; any deferred restart is handled before final cleanup. The interactive Autopilot assistant remains separate and appears during OOBE when configured. +[Domain Join](../domain-join/README.md) runs whenever it is enabled, even without custom actions. See [what happens in Windows](../../foundry-deploy/domain-join.md#what-happens-in-windows). + ## Prepare content Import a complete folder when the installer needs transforms, CAB files, configuration, scripts or other binaries. Preserve their relative paths. A single-file import includes only that file. @@ -106,6 +109,8 @@ PowerShell scripts must return a failure explicitly when appropriate. Non-termin **Continue on error** is disabled by default: a failure stops later actions and prevents a successful handoff to OOBE. Enabling it permits later actions after an ordinary, fully observed failure, recording the sequence as completed with errors. It does not allow execution to continue when Foundry cannot determine whether an action finished safely, or after an installer-owned restart. +A failed join or OU placement does not stop the other actions: Foundry reports a warning and continues, and it never repeats a join by itself. Check the outcome with [Domain Join troubleshooting](../../troubleshooting/domain-join.md) before handing over the computer. + Keep secrets out of command arguments and normal output. Profile encryption does not make arbitrary script output or installer logs safe to share. ## Restarts and interrupted deployments @@ -120,6 +125,8 @@ Installer exit code `1641` means the installer initiated its own restart. Foundr After a planned restart, Foundry resumes from its saved progress. If power is lost while an action is running, Foundry does not automatically retry that action. Missing or damaged execution records also stop the sequence. Inspect the results and logs before deciding whether to redeploy; scripts and installers are not necessarily safe to repeat. +If the computer is interrupted during the join, Foundry does not try the join again after the restart; it only checks whether the computer is a member of the domain. See [interrupted work](../../troubleshooting/domain-join.md#interrupted-work-or-restart-is-pending). + If an interrupted process might still be using files, Foundry retains them and reports cleanup as pending. This does not retry the interrupted action. ## Follow progress in Windows Setup diff --git a/foundry-osd/customization/unattend.md b/foundry-osd/customization/unattend.md index bfc9e1d..59c1798 100644 --- a/foundry-osd/customization/unattend.md +++ b/foundry-osd/customization/unattend.md @@ -23,7 +23,7 @@ Validate the answer file with Windows System Image Manager for the target Window 1. Open **Customization > Unattend** in Foundry OSD and enable the feature using the switch in the page header. Its controls remain disabled while the feature is off. The documentation button beside the switch opens this guide. 2. Import one or more XML files. Review the validation results and give each file a recognizable display label. 3. Choose a default file, or keep **Use Foundry settings** as the default. -4. Enable [Protected deployment](../general.md#protected-deployment) and enter the media password. Protection is required for every custom file, even one that appears to contain no credentials. +4. Enable [Password protection](../general.md#password-protection) and enter the deployment password. Protection is required for every custom file, even one that appears to contain no credentials. 5. Return to **Start**, resolve readiness errors, and [create deployment media](../media/README.md).
@@ -63,16 +63,19 @@ Foundry validates the selected file before preparing the target disk. After appl | Autopilot JSON profile or interactive registration | Known incompatible settings block deployment. Use a compatible file or change the authored Autopilot configuration. | | Hardware hash upload from WinPE | Registration can continue. A successful upload does not guarantee Autopilot enrollment. | | Upload computer name to Autopilot | Skipped because Foundry does not manage the final computer name. See [Machine naming](machine-naming.md#upload-the-computer-name-to-autopilot). | +| Domain Join | Requires exactly one fixed `ComputerName` in the `specialize` pass of `Microsoft-Windows-Shell-Setup`, and no `Microsoft-Windows-UnattendedJoin` component. Foundry joins the domain under that name. | A custom file does not disable every other Foundry feature. Test the file together with all enabled deployment options; do not assume arbitrary conflicts will be detected or resolved automatically. Foundry detects known XML conflicts but cannot predict arbitrary scripts. Arrange access to scripts referenced by the file; importing XML does not bundle those external files or execute its commands in WinPE. +For [Domain Join](../domain-join/README.md), a missing computer name, a `*` wildcard or several names are refused before the deployment starts; Foundry does not take the name from the wizard. Remove any `Microsoft-Windows-UnattendedJoin` component, and review your own commands that rename the computer or join a domain. Custom answer files still require Password protection. + Custom commands that replace setup hooks, restart Windows independently or change enrollment and package state can disrupt [Post-installation](post-installation.md#custom-answer-files). Test the complete combination before production use. ## Protect sensitive content -The complete custom file is encrypted on deployment media using the existing Protected deployment key. Protection does not extend to the original source file or the decrypted copy Windows needs on the target. +The complete custom file is encrypted on deployment media using the existing Password protection key. Protection does not extend to the original source file or the decrypted copy Windows needs on the target. Treat Panther answer files and their copies as sensitive. Windows password hiding is reversible, and custom commands or extensions can contain secrets that Windows will not automatically remove. Do not attach raw XML to support reports. @@ -87,10 +90,11 @@ Do not remove the target answer file before `oobeSystem` has consumed it. Arrang | Default file is missing from the catalog | In Foundry OSD, choose an available default or **Use Foundry settings**, then rebuild media. An invalid catalog default blocks deployment even if another runtime choice is available. | | File is incompatible with selected Windows | Use a file with supported components for that architecture and validate it against the target image. | | Autopilot conflict | Remove the incompatible settings from the source and refresh it, or change Autopilot configuration before rebuilding. | +| Domain Join conflict or invalid computer name | Correct the computer name in the `specialize` pass and remove the conflicting join component, refresh the source and create the media again. See [Domain Join troubleshooting](../../troubleshooting/domain-join.md). | | Deployment succeeds but Windows setup fails | Inspect Windows setup diagnostics without exposing secrets. Check the file against the selected image and test its commands and setup-hook dependencies. | After deployment, [verify Windows through first boot and OOBE](../../foundry-deploy/verify-deployment.md). A successful Foundry deployment does not confirm that Windows has consumed every answer-file setting. ## Custom images -Enabled answer files also apply to [custom Windows images](custom-windows-images.md). Foundry does not add an image-specific answer-file compatibility scan. Verify that your answer file is suitable for the image, its architecture, and the remaining customizations. +Enabled answer files also apply to [custom Windows images](custom-windows-images.md). Verify that your answer file is suitable for the image, its architecture, and the remaining customizations. For Domain Join, Foundry checks the applied image before preparing the join: an image that already contains a join component, or no single computer name, makes Foundry skip the join with a warning in the deployment summary. See [Domain Join troubleshooting](../../troubleshooting/domain-join.md#media-is-not-ready-or-input-is-rejected). diff --git a/foundry-osd/deployment-profiles.md b/foundry-osd/deployment-profiles.md index e089a2d..66838ea 100644 --- a/foundry-osd/deployment-profiles.md +++ b/foundry-osd/deployment-profiles.md @@ -17,7 +17,7 @@ A profile contains your deployment settings and, depending on your choices, pass Foundry saves changes automatically after a short pause and when you close the app. New local profiles start with **Remember passwords** enabled; existing profiles keep their saved choice. -If Foundry asks you to complete a password or select a missing file, do so before switching profiles or closing the app. Your current changes stay on screen, and the last successfully saved settings remain available. A new profile can start with incomplete inputs, but later saves with **Remember passwords** enabled require those inputs to be complete. +If Foundry asks you to complete a password or select a missing file, do so before switching profiles or closing the app. Your current changes stay on screen, and the last successfully saved settings remain available. A new profile can start with incomplete inputs, but later saves with **Remember passwords** enabled normally require those inputs to be complete. An omitted Domain Join password is the exception described [below](#domain-credentials). If saving or switching fails, Foundry keeps the current profile selected. Resolve the reported problem and try again. If saving fails while closing, cancel closing to fix it; choosing **Close** leaves you with the last successfully saved settings. @@ -30,7 +30,7 @@ These options control different things: | Option | What it does | | --- | --- | | Remember passwords | Saves supported deployment passwords and selected confidential files with this profile on this PC. | -| Include passwords and confidential files | Includes available passwords and selected confidential files when you export or share the configuration. | +| Include passwords and confidential files | Includes available passwords and selected confidential files when you export or share the configuration. Domain Join passwords are never included in a `.foundryprofile` export. | | Remember this connection on this PC | Lets Foundry reconnect to the shared configuration after restarting, without asking you to restore access. | Turning **Remember passwords** off stops saving passwords with future changes. Passwords already entered remain usable until the current session ends. Your separately remembered synchronization connection is also kept. To clear both, use **Clear saved passwords and access** beside the switch. @@ -39,7 +39,7 @@ Saved profiles are protected for your Windows account on this PC using Windows C When Foundry first brings your existing settings into a profile, **Remember passwords** starts enabled and saves supported passwords and selected files that are available. An existing profile's choice is preserved. -Supported passwords include Wi-Fi, Protected deployment, OOBE local accounts, and selected network or Autopilot PFX certificates. Complete required fields and matching confirmations. For an intentionally blank OOBE password, use its explicit password choice. Missing passwords are not filled from another profile. +Supported passwords include Wi-Fi, the deployment password, OOBE local accounts, selected network or Autopilot PFX certificates, and Domain Join accounts. Complete required fields and matching confirmations. For an intentionally blank OOBE password, use its explicit password choice. Missing passwords are not filled from another profile. Microsoft sign-in sessions are not transferred. Sign in again when an Autopilot task requires it. An imported Autopilot configuration with a valid saved registration can use its matching PFX certificate without a new sign-in. If that file was omitted, select the matching certificate and enter its password on this PC. A different or expired certificate must be resolved before creating media. @@ -53,6 +53,16 @@ If Foundry reports that cleanup is incomplete, resolve the reported problem and This action does not remove exported files, copies on the shared folder, original source files, or existing deployment media. +### Domain credentials + +[Zero-touch Domain Join](domain-join/zero-touch.md) passwords belong to their join account. **Remember passwords** keeps them with the profile on this PC. Turning it off stops keeping them from then on without clearing what is currently entered; **Clear saved passwords and access** also clears the passwords currently entered and the synchronization access. + +A `.foundryprofile` export never contains the join passwords, even with **Include passwords and confidential files** selected. Connection and recovery files do not contain them either, but they give access to the shared revisions, which can: protect those files and their passwords. + +An encrypted shared revision can contain the join passwords when you choose to include confidential content. When you receive a revision without passwords, Foundry keeps the password you already entered on this PC for a join account that is unchanged in the same profile. Changing or removing an account clears its password; changing the mode does not. + +A profile without its join passwords can be imported and saved with **Remember passwords** enabled. Creating Zero-touch media stays unavailable until you enter the passwords and set the technician password on that PC. + ## Export an encrypted package 1. Select the profile you want to transfer. @@ -62,7 +72,7 @@ This action does not remove exported files, copies on the shared folder, origina With the option off, the file contains settings without saved passwords or attached confidential files. Autopilot JSON entered in the configuration is still part of those settings; review it before sharing. -With the option on, Foundry includes available files selected in the configuration, such as custom answer files, wired or enterprise Wi-Fi XML profiles, and network or Autopilot PFX certificates. Missing files cannot be included. +With the option on, Foundry includes available files selected in the configuration, such as custom answer files, wired or enterprise Wi-Fi XML profiles, and network or Autopilot PFX certificates. Missing files cannot be included. Domain Join passwords are never included; the domains, accounts and OU lists are. An export supports up to **64 attached files**, **4 MiB per file**, and **8 MiB of attached files in total**. The complete configuration, including attachments, must fit within **16 MiB**. Transfer Windows images, driver collections, and generated media separately. @@ -75,7 +85,7 @@ Send the file password through a separate trusted channel. Anyone who can open t 3. Review the configuration name, included-file and password counts, and any missing-file notices. 4. Review **Remember passwords** and confirm that you want to use the imported settings. -**Remember passwords** is selected by default for a complete import. If passwords or files are missing, leave it unchecked, import the settings, supply the missing inputs, and then enable it. +**Remember passwords** is selected by default for a complete import. If other required passwords or files are missing, leave it unchecked, import the settings, supply the missing inputs, and then enable it. Missing Domain Join passwords do not prevent enabling it; enter them and set the technician password before creating Zero-touch media. Import creates an independent local copy. To keep it synchronized with a shared configuration, use **Set up synchronization… > Connect to a shared configuration** instead, even if the file you selected is a connection file. @@ -101,6 +111,8 @@ OneDrive, Dropbox, and other cloud-synchronized folders are not supported. If yo If Foundry asks for missing passwords or files, complete them before sharing confidential inputs. +For Domain Join, a shared revision can contain the join passwords. The connection file does not, but it gives access to the revisions; see [domain credentials](#domain-credentials). + If that configuration folder already exists, choose **Connect** and select its connection file, or choose **Choose another name**. Existing files are not overwritten. Renaming the configuration later does not move its shared folder. If sharing is interrupted, restore access to the folder and choose **Synchronize** on the same profile. Keep the folder and Foundry's local data intact while retrying. If you did not choose **Remember this connection on this PC**, keep Foundry open until the connection file is available; otherwise, you may be unable to reconnect after restarting. @@ -114,7 +126,7 @@ If sharing is interrupted, restore access to the folder and choose **Synchronize 5. Review the current shared settings, included-file and password counts, and remembering options. 6. Continue to use the reviewed configuration. If another PC changes it before you finish, Foundry shows an updated preview for you to confirm. -As with importing, **Remember passwords** is selected for complete configurations. If inputs are missing, connect first, supply them, and then enable it. Choose **Remember this connection on this PC** separately to reconnect automatically after restarting. +As with importing, **Remember passwords** is selected for complete configurations. If other required inputs are missing, connect first, supply them, and then enable it. Missing Domain Join passwords do not prevent it. Choose **Remember this connection on this PC** separately to reconnect automatically after restarting. If the suggested folder cannot be reached, browse to the connection file through a server address that works on this PC and check the suggested folder again. You can correct the folder before continuing. Select the configuration's own folder, not its parent share. @@ -191,7 +203,7 @@ Custom drivers remain local. Keep the selected driver folder focused on the targ Foundry cleans up its temporary copies after the build. If cleanup is interrupted, it retries when you restart or prepare another build. -Protect the media separately using [Protected deployment](general.md#protected-deployment) and the [deployment media security guidance](../reference/security-and-credentials.md). Recreate media when its included passwords or deployment settings change. +Protect the media separately using [Password protection](general.md#password-protection) and the [deployment media security guidance](../reference/security-and-credentials.md). Recreate media when its included passwords or deployment settings change. ## Custom image references diff --git a/foundry-osd/domain-join/README.md b/foundry-osd/domain-join/README.md new file mode 100644 index 0000000..16f3274 --- /dev/null +++ b/foundry-osd/domain-join/README.md @@ -0,0 +1,84 @@ +# Domain Join + +Use **Domain Join** to join the computer to an Active Directory domain during deployment, before the first sign-in. Two modes are available: + +| Mode | Who supplies the join account | Use it when | +| --- | --- | --- | +| [Zero-touch](zero-touch.md) | The media, protected by the technician password | Deployments must run without typing domain credentials. | +| [Interactive](interactive.md) | The technician, during each deployment | The media is shared and must not carry domain credentials. | + +Only one of Zero-touch Domain Join, Interactive Domain Join and the [Windows Autopilot](../autopilot/README.md) modes can be active. Open the page you want and choose **Enable**; Foundry asks for confirmation when it replaces another active mode. **Disable** removes the join from new media and keeps your settings. + +
+ Zero-touch Domain Join page before it is enabled, with the Enable button and empty Domains and Organizational units cards +
A Domain Join page before it is enabled: choose Enable, then list the domains and their OUs.
+
+ +## Before configuring + +- **Network.** The join happens in installed Windows and needs the domain at that moment: the computer must reach the domain's DNS and a domain controller. Listing OUs in advance does not make an offline join possible, and the Internet check in Foundry Connect does not test access to the domain. +- **Join account.** Ask your Active Directory administrator for an account allowed to add computers to the domain, to reuse an existing computer account when a machine is redeployed, and to move computers to the OUs you list. Foundry does not check these permissions. +- **Computer name.** Give each computer a unique name with [Machine naming](../customization/machine-naming.md). With a [custom answer file](../customization/unattend.md), the file must set exactly one fixed computer name in its `specialize` pass and must not contain a `Microsoft-Windows-UnattendedJoin` component. +- **Windows edition.** Windows Home editions cannot join a domain: Foundry skips the join with a warning and the installation continues. See [supported editions](../../reference/supported-versions.md#domain-join). + +## List the domains + +Both pages share the same lists. One media can serve several domains; during deployment, one domain and one OU are used for the computer. + +Under **Domains**: + +1. Choose **Add**, enter the **Domain name** (a DNS name such as `corp.contoso.com`), then choose **Add domain**. In Zero-touch the dialog also asks which account joins that domain; see [Zero-touch Domain Join](zero-touch.md). You can list up to 32 domains. +2. The first domain you add becomes the default. To change it, select another domain and choose **Set as default**. + +What happens during deployment depends on how many domains you list: + +| Domains listed | Result | +| --- | --- | +| None (Interactive only) | The technician types the domain name. | +| One | Every deployment joins that domain. | +| Several | The technician chooses the domain. The default is preselected. | + +**Edit** changes the selected domain. Its name can be changed only while it lists no OUs; remove them first, or add a new domain. **Remove** deletes the selected domain together with its OUs; if it was the default, the first remaining domain becomes the default. + +## List the OUs of a domain + +Select a domain under **Domains**. The **Organizational units** card then shows the OUs of that domain only. + +1. Choose **Add**, enter a **Display name** such as `Workstations` and a **Distinguished name** such as `OU=Workstations,DC=corp,DC=contoso,DC=com`, then choose **Add OU**. The distinguished name must be an organizational unit of the selected domain, so it starts with `OU=`; a container such as `CN=Computers` is not accepted. If the entry is refused, the dialog explains why so you can correct it. You can list up to 1,024 OUs per domain. +2. Alternatively, [import OUs from the domain](#find-and-import-ous). +3. When a domain lists several OUs, select one and choose **Set as default** to preselect it for technicians. **Clear default** returns to no preselection. + +What happens during deployment depends on how many OUs the domain lists: + +| OUs listed for the domain | Result | +| --- | --- | +| None | The computer goes to the domain's default location. In Interactive mode the technician may type the distinguished name of an OU instead. | +| One | That OU is always used. It is shown as the default. | +| Several | The technician chooses one of them. The default, if you set one, is preselected; without one the technician must pick. | + +**Edit** changes the display name of the selected OU, for example to show technicians a clearer name than the one imported from the directory. The distinguished name stays the same, and a later import keeps your name. **Remove** deletes the selected OUs. + +Both tables are sorted by name; select a column header to sort differently. + +{% hint style="info" %} +For a Zero-touch deployment that asks the technician nothing, list one domain and at most one OU for it. +{% endhint %} + +## Find and import OUs + +Instead of typing distinguished names, you can read them from the domain. + +1. Select the domain under **Domains**. This computer must be able to reach that domain, and your Windows account must be allowed to read it. This is the case for the computer's own domain and for domains that trust it. +2. Under **Organizational units**, choose **Import from domain**. While the search runs, the same button becomes **Cancel search**. +3. In the dialog, select the OUs to keep, then choose **Add selected OUs**. OUs already listed for that domain are not offered again, and no OU is selected for you. +4. Review the resulting list and the default. + +The search uses your Windows account, not the join account, so it does not prove that the join account can use these OUs. When the domain holds more OUs than the search can return, the dialog says that only some of them are listed. If the domain cannot be searched, add the OUs manually. + +## Existing computer accounts + +When a computer account with the same name already exists in the domain, for example when a machine is redeployed, Foundry reuses it instead of creating a new one. If an OU applies, the existing account is moved to that OU without being deleted, so its group memberships and policies are kept. Without an OU, an existing account stays where it is. + +## Create the media and check the result + +Resolve the messages shown on the page, then [create or update the media](../media/README.md). The join itself runs after Windows is installed; see [Domain Join during deployment](../../foundry-deploy/domain-join.md) for what the technician does and how to check the outcome, and [Domain Join troubleshooting](../../troubleshooting/domain-join.md) when something goes wrong. diff --git a/foundry-osd/domain-join/interactive.md b/foundry-osd/domain-join/interactive.md new file mode 100644 index 0000000..6d89dfb --- /dev/null +++ b/foundry-osd/domain-join/interactive.md @@ -0,0 +1,35 @@ +# Interactive Domain Join + +Choose this mode when the media must not carry domain credentials: the technician enters a domain account and its password during each deployment. + +## Prepare the media + +1. Open **Domain Join > Interactive** and choose **Enable**. Confirm the replacement if another Domain Join or Autopilot mode is active. +2. Optionally [list the domains](README.md#list-the-domains) technicians may join. With at least one domain listed, the technician joins one of them and cannot type another; with none, the technician types the domain name during deployment. +3. Optionally [add or import OUs](README.md#list-the-ous-of-a-domain) for each domain. A single OU is always used; with several, technicians choose one and the default is preselected. +4. Resolve the messages shown on the page, then [create or update the media](../media/README.md). + +Interactive Domain Join does not need [Password protection](../general.md#password-protection) and writes no join account or password to the media. Accounts and passwords entered on the Zero-touch page stay in your configuration for a later switch back, but are never written to Interactive media. Other options you enable, such as custom answer files, may still require Password protection. + +Choose **Disable** to remove the join from new media. Your settings stay available for later. + +
+ Interactive Domain Join page listing three domains and the OUs of the selected domain +
Interactive mode lists domains and OUs only; no account or password is stored.
+
+ +## What the technician does + +The Deploy wizard shows a **Domain join** step before **Summary**: + +1. **Domain name**: choose it when the media lists several domains. With one listed domain it is shown and cannot be changed; with none, type it. +2. **Account** and **Password**: enter the join account, as `DOMAIN\user` or `user@domain`, and its password. For example, an administrator may supply `djoin@corp.contoso.com` for `corp.contoso.com`. +3. **Organizational unit**: choose one when the domain lists several; the default, if you set one, is preselected. A domain that lists a single OU uses it without asking. For a domain without listed OUs, **OU distinguished name (optional)** accepts an OU of that domain; leave it empty to use the domain's default location. + +Changing the domain replaces the OU choices with those of the new domain and keeps the account and password already typed. + +{% hint style="info" %} +The wizard does not contact the domain, so a mistyped password is not detected at this step. It shows later, in installed Windows, as a failed join. +{% endhint %} + +The technician reviews the domain and the OU in the **Domain join** category of the summary before starting. See [Domain Join during deployment](../../foundry-deploy/domain-join.md) for the full procedure and for how to check the outcome. diff --git a/foundry-osd/domain-join/zero-touch.md b/foundry-osd/domain-join/zero-touch.md new file mode 100644 index 0000000..2a0b2f5 --- /dev/null +++ b/foundry-osd/domain-join/zero-touch.md @@ -0,0 +1,54 @@ +# Zero-touch Domain Join + +Choose this mode when the media should carry the join account, so technicians do not type domain credentials. The credentials are protected by the technician password of [Password protection](../general.md#password-protection). + +## Prepare the media + +1. In [General configuration](../general.md#password-protection), turn on **Password protection** and enter the **Deployment password**. Zero-touch Domain Join cannot be used without it. +2. Open **Domain Join > Zero-Touch** and choose **Enable**. Confirm the replacement if another Domain Join or Autopilot mode is active. +3. Under **Shared join account**, enter the **Account**, as `DOMAIN\user` or `user@domain`, and its **Password**. Every domain uses this account unless you give it its own. Use an account provided by your Active Directory administrator, such as `djoin@corp.contoso.com`. +4. Under **Domains**, [add each domain](README.md#list-the-domains). To join a domain with a different account, choose **Use a dedicated account** in the domain dialog and enter that account and its password. +5. Optionally [add or import OUs](README.md#list-the-ous-of-a-domain) for each domain. +6. Resolve the messages shown on the page, then [create or update the media](../media/README.md). + +The **Status** column of the Domains table says what each domain still needs: **Ready**, or for example a missing password. Problems with the shared account are shown under that account. + +
+ Zero-touch Domain Join page with a shared join account, three domains marked Ready and the OUs of the selected domain +
Each domain uses the shared account or its own, and shows Ready when nothing is missing.
+
+ +## What the technician sees + +During deployment the technician unlocks the media with the technician password, as for any protected media. There is no prompt for the domain account or its password. + +| Media | Domain join step in the Deploy wizard | +| --- | --- | +| One domain, and at most one OU for it | Not shown. The deployment asks nothing about the domain. | +| Several domains | Shown, to choose the domain. The default is preselected. | +| Several OUs for the domain being joined | Shown, to choose the OU. The default, if you set one, is preselected. | + +See [Domain Join during deployment](../../foundry-deploy/domain-join.md). + +## Passwords and profiles + +A password belongs to its account, whether shared or dedicated: + +- Changing an account, or removing the last domain that uses a dedicated account, clears its password. +- Renaming a domain, switching to Interactive and choosing **Disable** keep the passwords, so returning to Zero-touch needs no retyping. Kept passwords are only ever written to Zero-touch media. + +On the media, each domain has its own encrypted copy of its account and password. A copy written for one domain cannot be used to join another. + +With [deployment profiles](../deployment-profiles.md#domain-credentials): + +- **Remember passwords** keeps the join passwords with the profile on this PC. +- A `.foundryprofile` export never contains the join passwords, even with **Include passwords and confidential files** selected. After importing such a profile on another PC, enter the join passwords and set the technician password there before creating media. +- An encrypted shared revision can contain the join passwords when you choose to include confidential content. Restrict access to its connection and recovery files and to their passwords accordingly. + +Create or update the media again after changing an account or a password. Media already created keeps the credentials it was built with. + +## Check the result + +The join runs after Windows is installed and needs the domain to be reachable at that moment. Follow [Domain Join during deployment](../../foundry-deploy/domain-join.md#what-happens-in-windows) to check that the computer joined the domain and reached the intended OU. + +During deployment, the credentials of the domain being joined are copied to the target disk, in a folder that only SYSTEM and administrators can read. They are used once in installed Windows and then deleted. See [how domain credentials are handled](../../reference/security-and-credentials.md#domain-credentials). diff --git a/foundry-osd/general.md b/foundry-osd/general.md index 0b50e42..78aa4aa 100644 --- a/foundry-osd/general.md +++ b/foundry-osd/general.md @@ -36,9 +36,9 @@ Validate custom drivers on representative hardware before using the media in pro
Configure platform, Windows PE, deployment completion, and driver settings.
-## Protected deployment +## Password protection -**Protected deployment** requires a technician password before Foundry Deploy initializes. Enable it to protect the following deployment data on generated media: +**Password protection** requires a technician password before Foundry Deploy initializes. Turn it on and enter the **Deployment password** to protect the following deployment data on generated media: | Data | Protected by the technician password | | --- | --- | @@ -46,15 +46,18 @@ Validate custom drivers on representative hardware before using the media in pro | Autopilot certificate credentials for zero-touch upload, including the PFX file and its password | Yes | | Autopilot JSON profiles | Yes | | Custom Windows answer files | Yes | +| Zero-touch Domain Join accounts and passwords | Yes; Password protection is required | | Embedded Wi-Fi passwords, wired and Wi-Fi certificate PFX passwords, and network certificate private keys | No | -Foundry Connect uses embedded network credentials before Foundry Deploy asks for the technician password, so automatic network setup remains available. Anyone who can read the ISO or USB can recover those network credentials, even when Protected deployment is enabled. Restrict access to the media and use dedicated network credentials that can be revoked. +Foundry Connect uses embedded network credentials before Foundry Deploy asks for the technician password, so automatic network setup remains available. Anyone who can read the ISO or USB can recover those network credentials, even when Password protection is enabled. Restrict access to the media and use dedicated network credentials that can be revoked. Foundry accepts passwords from 8 characters and recommends at least 12 characters. Use a unique password for each set of deployment media and store it using the organization’s approved credential-management process. -Protected deployment does not encrypt the complete ISO, USB drive, Windows image, or files staged into the installed Windows system. +Password protection does not encrypt the complete ISO, USB drive, Windows image, or files staged into the installed Windows system. -When Protected deployment is disabled, Autopilot JSON profiles remain readable on the media and other embedded deployment credentials can be recovered without a technician password. Treat possession of unprotected media as access to all embedded deployment information. +[Zero-touch Domain Join](domain-join/zero-touch.md) requires Password protection: the join accounts are unlocked with the same technician password, without a separate prompt. [Interactive Domain Join](domain-join/interactive.md) does not require it. See [how domain credentials are handled](../reference/security-and-credentials.md#domain-credentials). + +When Password protection is disabled, Autopilot JSON profiles remain readable on the media and other embedded deployment credentials can be recovered without a technician password. Treat possession of unprotected media as access to all embedded deployment information. {% hint style="warning" %} If you no longer have the technician password, recreate the media with a new password. diff --git a/foundry-osd/media/README.md b/foundry-osd/media/README.md index 71a584d..5769a34 100644 --- a/foundry-osd/media/README.md +++ b/foundry-osd/media/README.md @@ -8,6 +8,8 @@ Choose the intended [deployment profile](../deployment-profiles.md) before start Resolve every blocking readiness item before starting. Checks cover Windows ADK and Windows PE, architecture, language, boot-image source, output paths, USB target, media options, drivers, networking, runtime configuration, secrets, customization, and Windows Autopilot. +[Domain Join](../domain-join/README.md) must also be complete for the active mode. Zero-touch needs at least one domain, an account and its password for each domain, and Password protection. Interactive needs none of them. These checks do not test whether the domain is reachable or whether the account is allowed to join computers. +
Foundry OSD media creation readiness overview
Resolve every blocking item before creating or updating deployment media.
diff --git a/foundry-osd/network/README.md b/foundry-osd/network/README.md index 7f3755a..2a93590 100644 --- a/foundry-osd/network/README.md +++ b/foundry-osd/network/README.md @@ -8,7 +8,7 @@ Configure network settings that Foundry Connect can use in Windows PE. - Use [Ethernet 802.1X](ethernet-802.1x.md) when wired access requires enterprise authentication. - Skip network provisioning when target devices use an unrestricted wired connection with DHCP. -Only include profiles and certificates required for deployment. [Protected deployment](../general.md#protected-deployment) does not protect embedded network credentials: anyone who can read the ISO or USB can recover them. Restrict media access and use dedicated network credentials that can be revoked. Foundry Connect uses these credentials before the technician enters the deployment password, so automatic network setup remains available. +Only include profiles and certificates required for deployment. [Password protection](../general.md#password-protection) does not protect embedded network credentials: anyone who can read the ISO or USB can recover them. Restrict media access and use dedicated network credentials that can be revoked. Foundry Connect uses these credentials before the technician enters the deployment password, so automatic network setup remains available. Use [deployment profiles](../deployment-profiles.md) to retain network settings and explicitly selected passwords or files, or to transfer them in an encrypted package. Review missing credentials and local certificate paths after activating or importing a profile. diff --git a/foundry-osd/settings.md b/foundry-osd/settings.md index 30f5026..9ef5d7f 100644 --- a/foundry-osd/settings.md +++ b/foundry-osd/settings.md @@ -12,6 +12,8 @@ The application language changes the Foundry interface. Choose the Windows PE an Choose **Export diagnostics** to create a support archive with sensitive information filtered out. Your original log files are unchanged. +The export collects only the desktop application's top-level `Foundry*.log` files, not the logs written on deployed computers. For Domain Join, recognized credential values are masked in sanitized output, and the temporary `credentials.bin` file is never read or included. See [which files to collect on the deployed computer](../troubleshooting/logs-and-support.md#domain-join-evidence). + Use **Advanced: export raw logs** only when a support contact requests it. Raw logs can contain passwords, identifiers, paths, and network details. Review the warning and destination before sharing them. See [Logs and support](../troubleshooting/logs-and-support.md) for help collecting and sharing diagnostic information. ## Appearance @@ -46,6 +48,8 @@ Select a configuration from the list to apply it immediately. Expand the card to See [Deployment profiles](deployment-profiles.md) for step-by-step instructions, the differences between remembering and sharing passwords, and help with connection files or conflicting changes. +For Zero-touch Domain Join, see [how join passwords are kept, exported and shared](deployment-profiles.md#domain-credentials). **Include passwords and confidential files** never adds them to a `.foundryprofile` export. + ## Proxy Use **Proxy** when Foundry OSD needs a proxy to reach online services. diff --git a/reference/security-and-credentials.md b/reference/security-and-credentials.md index f807523..e71feb2 100644 --- a/reference/security-and-credentials.md +++ b/reference/security-and-credentials.md @@ -10,10 +10,11 @@ Depending on configuration, media may include or use: - Trusted root certificates. - Windows Autopilot tenant and application information. - Certificate-based application credentials. -- Protected deployment and its technician password. +- Password protection and its technician password. - Predefined passwords for local Windows accounts created during OOBE. - Custom Windows answer files, including credentials in their settings or commands. - Device hardware hashes and registration artifacts. +- Active Directory join credentials for Domain Join. ## Required practices @@ -22,22 +23,35 @@ Depending on configuration, media may include or use: - Rotate certificates before expiration and after suspected exposure. - Revoke credentials when media is lost or cannot be accounted for. - Sanitize logs, screenshots, and issue attachments. -- Recreate media when a Protected deployment password is lost. +- Recreate media when the deployment password is lost. ## Deployment media protection -Review the [Protected deployment scope](../foundry-osd/general.md#protected-deployment) before choosing credentials and files to include on media. The technician password protects the listed deployment data; embedded network credentials remain accessible to anyone who can read the ISO or USB. +Review the [Password protection scope](../foundry-osd/general.md#password-protection) before choosing credentials and files to include on media. The technician password protects the listed deployment data; embedded network credentials remain accessible to anyone who can read the ISO or USB. -- Every retained [Autopilot JSON profile](../foundry-osd/autopilot/json-profile.md) is readable on media created without Protected deployment. -- [Zero-touch upload](../foundry-osd/autopilot/zero-touch-hardware-hash.md) credentials can be recovered from media created without Protected deployment. -- Non-empty [OOBE local account passwords](../foundry-osd/customization/oobe.md#password-protection) require Protected deployment under Foundry's security policy and are encrypted in the deployment configuration. During Windows Setup, they are written to `unattend.xml` using reversible encoding, not encryption. Treat that answer file and its copies as sensitive data. -- Protected deployment does not encrypt the complete ISO, USB drive, Windows image, or data staged into the installed Windows system. +- Every retained [Autopilot JSON profile](../foundry-osd/autopilot/json-profile.md) is readable on media created without Password protection. +- [Zero-touch upload](../foundry-osd/autopilot/zero-touch-hardware-hash.md) credentials can be recovered from media created without Password protection. +- Non-empty [OOBE local account passwords](../foundry-osd/customization/oobe.md#password-protection) require Password protection under Foundry's security policy and are encrypted in the deployment configuration. During Windows Setup, they are written to `unattend.xml` using reversible encoding, not encryption. Treat that answer file and its copies as sensitive data. +- Password protection does not encrypt the complete ISO, USB drive, Windows image, or data staged into the installed Windows system. +- [Zero-touch Domain Join](../foundry-osd/domain-join/zero-touch.md) requires Password protection; its accounts are unlocked with the technician password. [Interactive mode](../foundry-osd/domain-join/interactive.md) collects the account and password in the Deploy wizard and does not require Password protection. If media is lost, stolen, or copied without authorization, revoke embedded credentials where applicable and recreate the media. Do not rely on the technician password as a substitute for physical media controls. +## Domain credentials + +In Foundry OSD, a join password belongs to its account, shared or dedicated. On Zero-touch media, each domain has its own encrypted copy of its account and password, which cannot be used to join another domain. **Remember passwords** and encrypted shared revisions can keep the passwords when you choose so; a `.foundryprofile` export never contains them. Connection and recovery files do not contain them either, but they give access to shared revisions that can. See [domain credentials in profiles](../foundry-osd/deployment-profiles.md#domain-credentials). + +During deployment, Deploy copies the account and password of the domain being joined to the target disk, unencrypted, in `%SystemRoot%\Temp\Foundry\Payloads\DomainJoin\\credentials.bin`. The folder is restricted to SYSTEM and Administrators before the file is written. Only the join reads it; the later membership check uses no credentials. Access to the disk and the physical security of the computer remain your responsibility until the file is deleted. + +Foundry erases its own copies of the password from memory as soon as it has used them. The Windows components that perform the join keep their own copies during the operation, which Foundry cannot erase. The join is limited to five minutes, including up to two minutes waiting for a domain controller. + +Foundry deletes the file as soon as the join has used it. If the deletion fails, or if the join was interrupted, the cleanup stays **Pending** with a warning and is tried again at the next start. An administrator can delete a leftover file once the computer is no longer running Foundry actions. Never copy it into a support request. See [credential cleanup](../troubleshooting/domain-join.md#credential-cleanup-remains-pending). + +Support bundles never include a file named `credentials.bin`. A copy saved under another name would not be recognized, so do not copy or rename this file. + ## Custom answer files -Using [custom answer files](../foundry-osd/customization/unattend.md) requires Protected deployment for every embedded file. The complete XML is encrypted on media. Source files and the decrypted `Windows\Panther\unattend.xml` on the target still require access controls. +Using [custom answer files](../foundry-osd/customization/unattend.md) requires Password protection for every embedded file. The complete XML is encrypted on media. Source files and the decrypted `Windows\Panther\unattend.xml` on the target still require access controls. Custom XML may contain passwords or secrets in commands and extensions. Do not assume Windows will scrub them. Keep the target file until its required setup passes finish, then arrange cleanup through the deployment process. Do not include raw answer files in support attachments. diff --git a/reference/supported-versions.md b/reference/supported-versions.md index db8f8c4..521ee2f 100644 --- a/reference/supported-versions.md +++ b/reference/supported-versions.md @@ -41,3 +41,13 @@ The [custom image workflow](../foundry-osd/customization/custom-windows-images.m [Post-installation](../foundry-osd/customization/post-installation.md) supports x64 and ARM64 targets. Bootstrap prepares PostInstall for the boot media architecture; you do not need to install .NET on the target. Use boot media matching the target Windows architecture. Deploy checks runtime compatibility before preparing the disk. Keep deployment media and its package content together, and choose scripts and installers compatible with the target Windows image and architecture. Test the complete workflow on representative hardware before rollout. + +## Domain Join + +[Domain Join](../foundry-osd/domain-join/README.md) is available on x64 and ARM64 for Windows editions that can join a domain. + +Use media that matches the architecture of the computer, and test the complete workflow before a rollout. + +Pro, Education and Enterprise editions, including their N variants, can join a domain. Home editions (`Core`, `CoreN`, `CoreSingleLanguage`, `CoreCountrySpecific`) cannot: Foundry skips the join with a warning and the installation continues. For an edition Foundry does not recognize, the decision is made from the applied image. + +Installed Windows must reach the domain's DNS and a writable domain controller, and the join account must be allowed to join computers, reuse existing computer accounts and place computers in the listed OUs. Custom answer files and custom images must meet the [Domain Join requirements](../troubleshooting/domain-join.md#media-is-not-ready-or-input-is-rejected). diff --git a/reference/telemetry-and-privacy.md b/reference/telemetry-and-privacy.md index c4b18a6..3d80eca 100644 --- a/reference/telemetry-and-privacy.md +++ b/reference/telemetry-and-privacy.md @@ -47,6 +47,19 @@ Counts are capped at 1,000 and describe the configuration captured for the media Action names, commands, arguments, file names, paths, content hashes, and script contents are excluded. **Settings > Enable telemetry** controls this collection. +### Domain Join + +When telemetry is enabled, [Domain Join](../foundry-osd/domain-join/README.md) uses the existing media-creation and deployment events: + +| Event | Domain Join information | +| --- | --- | +| `osd:boot_media_finished` | `domain_join_enabled`, `domain_join_mode` (`disabled`, `interactive` or `zero_touch`), `domain_join_domain_count`, `domain_join_shared_account_used`, `domain_join_ou_count`, and `domain_join_default_ou_set`. | +| `deploy:session_finished` | `deploy_domain_join_enabled`, `deploy_domain_join_mode`, `deploy_domain_join_domain_source` and `deploy_domain_join_ou_source` (each `none`, `default`, `selected` or `typed`), and `deploy_domain_join_status` (`disabled`, `pending`, `staged`, `skipped_unsupported_edition` or `skipped_image_composition`). | + +A disabled mode reports zero domains, zero OUs and no default, even when a draft is saved. The domain count is capped at 32. The OU count is the total across domains, and the default OU flag is set when any domain has one. The deployment status describes how far Foundry Deploy took the join; `staged` means the join was handed to installed Windows. Joining, OU placement and membership verification run later in Windows and are not reported, so telemetry does not show whether a computer actually joined the domain. + +Domain names, account names, passwords, OU names, distinguished names, and computer names are excluded. + ## Remote error diagnostics **Enable remote diagnostics** controls operational logs and exception reports sent to PostHog. This preference is separate from anonymous product telemetry, applies immediately to new diagnostic records, and is written to newly created media for Foundry Bootstrap, Foundry Connect, and Foundry Deploy. Changing it does not update existing media. diff --git a/start-here/deployment-workflow.md b/start-here/deployment-workflow.md index 3c62fae..39f26c2 100644 --- a/start-here/deployment-workflow.md +++ b/start-here/deployment-workflow.md @@ -9,7 +9,7 @@ Use **Foundry OSD** on an administrator workstation to: - Install or validate Windows ADK and Windows PE components. - Configure networking and deployment behavior. - Select Windows customization options. -- Configure an optional Windows Autopilot workflow. +- Choose Windows Autopilot or [Domain Join](../foundry-osd/domain-join/README.md) when required; only one of them can be active. - Create or update ISO and USB media. ## Phase 2: Establish network readiness @@ -27,6 +27,8 @@ The [Windows PE bootstrap](../reference/bootstrap.md) prepares this session and - Driver pack selection. - Firmware and Windows Autopilot options when configured. +[Domain Join](../foundry-deploy/domain-join.md) adds a wizard step before the summary when there is something to enter or choose: the account and password on Interactive media, and the domain or the OU when the media lists several. + ## Phase 4: Apply and configure Windows Foundry prepares the target disk, downloads and applies Windows, stages drivers and configuration, provisions recovery and optional features, and completes the deployment handoff. @@ -35,13 +37,17 @@ Foundry prepares the target disk, downloads and applies Windows, stages drivers Review the completion state, deployment summary, and any reported error. Reboot only after Foundry reports success or after collecting the required troubleshooting evidence. +## Phase 6: Verify installed-Windows work + +After the restart, Windows setup runs the [post-installation](../foundry-osd/customization/post-installation.md) actions before the first sign-in. Domain Join runs there, restarts Windows once, then checks that the computer is a member of the domain. A successful deployment in WinPE only means the join was prepared. Check the [outcome](../foundry-deploy/verify-deployment.md#domain-join) before handing over the computer. +
Foundry deployment workflow from media authoring through network readiness, Windows deployment, verification, and reboot
- Foundry OSD authors deployment media, Foundry Connect establishes network readiness, and Foundry Deploy applies and verifies Windows. + Foundry OSD authors deployment media, Foundry Connect establishes network readiness, and Foundry Deploy applies Windows. The post-installation actions, including Domain Join, run after the restart.
diff --git a/start-here/quick-start.md b/start-here/quick-start.md index 50b2a6a..7515e6a 100644 --- a/start-here/quick-start.md +++ b/start-here/quick-start.md @@ -14,13 +14,14 @@ See [Windows ADK and Windows PE](../foundry-osd/adk.md). ## 3. Review general configuration -Open **General configuration** and confirm the deployment settings. Review the [Protected deployment scope](../foundry-osd/general.md#protected-deployment) and enable it for the deployment data you need to protect. Embedded network credentials remain accessible without the technician password. Follow the organization’s removable-media policy for every deployment image. +Open **General configuration** and confirm the deployment settings. Review the [Password protection scope](../foundry-osd/general.md#password-protection) and enable it for the deployment data you need to protect. Embedded network credentials remain accessible without the technician password. Follow the organization’s removable-media policy for every deployment image. ## 4. Configure only what you need - Add Wi-Fi or Ethernet 802.1X settings when the target cannot use an open wired network. - Choose Windows customization options required by the organization. - Configure Windows Autopilot only when the device must be registered or receive a profile. +- Alternatively, configure [Domain Join](../foundry-osd/domain-join/README.md). It replaces the active Autopilot mode. Zero-touch Domain Join requires Password protection; Interactive does not. ## 5. Create deployment media @@ -42,5 +43,8 @@ In Foundry Deploy: 2. Select a Windows release, language, edition, and license channel. 3. Select a compatible driver pack. 4. Configure Windows Autopilot when JSON profile or zero-touch upload media displays that step. Interactive upload runs later during Windows OOBE. -5. Review the summary and start deployment. -6. Verify the success page before rebooting. +5. For Domain Join, complete the [Domain join step](../foundry-deploy/domain-join.md) when the wizard shows it. +6. Review the summary and start deployment. +7. Verify the success page before rebooting. + +For Domain Join, a successful deployment means the join was prepared. It runs after the restart; check that the computer joined the domain before handing it over. diff --git a/troubleshooting/README.md b/troubleshooting/README.md index 9f3f4fe..845b759 100644 --- a/troubleshooting/README.md +++ b/troubleshooting/README.md @@ -8,5 +8,8 @@ Start with the stage where the workflow stopped. | Ethernet, Wi-Fi, DHCP, or Foundry Connect | [Network and Foundry Connect](network.md) | | Target, Windows, drivers, or deployment execution | [Windows deployment](deployment.md) | | Profile staging or hardware hash upload | [Windows Autopilot](autopilot.md) | +| Joining the domain, OU placement or leftover join credentials | [Domain Join](domain-join.md) | Before changing configuration, record the visible status, failed step, complete error message, device model, media version, and selected workflow. Then collect [logs and support information](logs-and-support.md). + +For Domain Join, collect the result file and the log listed in [Domain Join evidence](logs-and-support.md#domain-join-evidence). Never include the `credentials.bin` file, an account or a password. diff --git a/troubleshooting/deployment.md b/troubleshooting/deployment.md index e5d8633..f05deef 100644 --- a/troubleshooting/deployment.md +++ b/troubleshooting/deployment.md @@ -6,6 +6,8 @@ Use 1–15 ASCII letters, numbers, or hyphens, and avoid a name containing only In the composed naming workflow, a missing hardware value or firmware placeholder also prevents generation. If editing is allowed, enter a valid complete name. Otherwise, correct the naming configuration and refresh the media. See [machine naming](../foundry-osd/customization/machine-naming.md) for naming requirements and editing options. +For Domain Join with a custom answer file, the file must set exactly one fixed computer name in its `specialize` pass; Foundry does not replace a missing or `*` name. See [Domain Join troubleshooting](domain-join.md#media-is-not-ready-or-input-is-rejected). + ## Target disk is unavailable - Confirm the storage controller is supported in Windows PE. @@ -75,3 +77,5 @@ For [custom images](../foundry-osd/customization/custom-windows-images.md), chec ## Post-installation interruption For [Post-installation](../foundry-osd/customization/post-installation.md), distinguish WinPE staging from the later Windows sequence. Planned restarts resume from saved progress. An interrupted action, missing or damaged execution records, or an installer-owned restart stops the sequence without automatically retrying the action. Preserve the results and logs before deciding whether to redeploy. **Cleanup pending** means some temporary content could not yet be safely removed. + +[Domain Join](domain-join.md#interrupted-work-or-restart-is-pending) is an exception: when the join is interrupted, Foundry reports a warning, does not try the join again, and continues after the restart. diff --git a/troubleshooting/domain-join.md b/troubleshooting/domain-join.md new file mode 100644 index 0000000..12935b5 --- /dev/null +++ b/troubleshooting/domain-join.md @@ -0,0 +1,112 @@ +# Domain Join troubleshooting + +Start from where the problem shows: in Foundry OSD while preparing the media, in the Deploy wizard, or in installed Windows after the restart. + +## Where to look + +| Where | What it tells you | +| --- | --- | +| The Domain Join page in Foundry OSD | Messages under each card and the **Status** column of the Domains table say what is missing before media can be created. | +| The **Domain join** step and the summary in Foundry Deploy | Messages under each field, and the domain and OU the join will use. | +| The Foundry console during Windows setup | One line summarizes the join, for example `Domain - Join: Failed; Placement: Skipped; Membership: Skipped; Restart: NotRequired; Cleanup: Disposed`. | +| `%SystemRoot%\Temp\Foundry\State\PreOobe\domain-join-result.json` | The same outcome with a reason (`failureCode`) and numeric error codes. | +| `%SystemRoot%\Temp\Foundry\Logs\PreOobe\Foundry.PostInstall.log` | The detailed log of the join. | + +To read the files while Windows setup is still on screen, press **Shift+F10** to open a command prompt. See [which files to collect](logs-and-support.md#domain-join-evidence) before asking for help. + +Each part of the outcome (join, placement in the OU, membership) has its own state: + +| State | Meaning | +| --- | --- | +| Succeeded | That part completed. | +| Failed | That part failed; the reason is in the result file. | +| Skipped | That part did not apply, or was not attempted because an earlier part failed. | +| Unknown | The operation was interrupted, so the directory may or may not have been changed. | +| Unverified | The operation was requested but its result could not be confirmed. | +| NotStarted | Nothing was recorded for that part yet. | + +## Media is not ready or input is rejected + +**In Foundry OSD** + +| Message or symptom | What to do | +| --- | --- | +| A domain shows a missing password or account in **Status** | Select the domain and choose **Edit**, or complete the **Shared join account** card. Each domain needs an account written as `DOMAIN\user` or `user@domain`, with its password. | +| Turn on password protection on the General page and set the deployment password | Zero-touch needs [Password protection](../foundry-osd/general.md#password-protection). Turn it on in **General configuration** and enter the **Deployment password**. | +| Add at least one domain | Zero-touch needs one listed domain or more. Interactive can list none. | +| The passwords are empty after importing a profile | A `.foundryprofile` export never contains the join passwords. Enter them again, and set the technician password on this PC. | +| A domain cannot be renamed | Its name is locked while it lists OUs. Remove its OUs first, or add the new domain and remove the old one. | +| An OU is refused | The distinguished name must be an organizational unit of the selected domain: it starts with `OU=` and ends with that domain's `DC=` parts. A container such as `CN=Computers` is not accepted. | +| **Import from domain** finds nothing or fails | The search uses your Windows account. It fails when this computer cannot reach the domain or when the domain does not trust your account. Add the OUs manually instead. | + +**In the Deploy wizard** + +| Message or symptom | What to do | +| --- | --- | +| **Next** is unavailable on the Domain join step | Correct the fields that show a message: a valid domain name, an account written as `DOMAIN\user` or `user@domain`, a password, and an OU when the domain lists several. | +| Another domain cannot be typed | When the media lists domains, only those can be joined. Ask the administrator to add the domain in Foundry OSD. | +| The typed OU is refused | A typed OU is only offered for a domain without listed OUs. It must start with `OU=` and belong to the chosen domain. | +| The Domain join step is not shown | On Zero-touch media this is expected when the media lists one domain and at most one OU for it: there is nothing to choose. | +| The Domain join step appears on Zero-touch media | The media lists several domains, or several OUs for the domain. To avoid the step, the administrator lists one domain and at most one OU. | +| "The domain join information is missing or not valid. Deployment has not started." | Return to the Domain join step and check the entries. With a custom answer file, check its computer name as described below. | +| The summary says the edition cannot join a domain | Windows Home editions cannot join a domain. Choose another edition, or continue without the join. See [supported editions](../reference/supported-versions.md#domain-join). | + +**With a custom answer file or a custom Windows image** + +The answer file must set exactly one fixed computer name in its `specialize` pass; a missing name, a `*` wildcard or several names are refused, and Foundry does not fill the name from the wizard. Neither the answer file nor the image may contain a `Microsoft-Windows-UnattendedJoin` component, because Foundry performs the join itself. When Foundry finds such a conflict in the applied image, it skips the join with a warning in the deployment summary and the installation continues. + +## Windows asks who will use the device + +Setup ends on the sign-in screen only after Foundry has confirmed that the computer is a member of the domain. When it stops on **Who's going to use this device?** instead, the join failed or could not be confirmed. Create a local account to reach the desktop, then follow [Joining fails](#joining-fails). + +The page also appears with a [custom answer file](../foundry-osd/customization/unattend.md) that creates no account, because that file decides which setup screens appear. Create the account in that file. + +## Joining fails + +Open `domain-join-result.json` and read `failureCode` and the numeric codes under `join`: + +| What the result shows | Likely cause | What to do | +| --- | --- | --- | +| `DomainUnavailable` with `ldapErrorCode` 49, or `JoinFailed` with `nativeErrorCode` 1326 | The directory refused the account or its password. | Check the account and password. On Zero-touch media, correct them in Foundry OSD and create the media again. | +| `ReadinessTimeout`, or `DomainUnavailable` with another code | No domain controller answered within two minutes. | Check the network driver and connection in installed Windows, the DNS servers given to the computer, and its date and time. A working Internet connection does not prove that the domain is reachable. | +| `JoinFailed` with `nativeErrorCode` 1355 | The domain was not found. | Check the domain name and DNS. | +| `JoinFailed` with `nativeErrorCode` 5 | Access denied: the account is not allowed to join computers. | Ask the Active Directory administrator to review the account's permissions. | +| `JoinFailed` with `nativeErrorCode` 2224 or 2732 | A computer account with this name exists and the join account may not reuse it. | Windows restricts the reuse of existing computer accounts; see Microsoft's [KB5020276 guidance](https://support.microsoft.com/en-us/servicing/os/windows/2022/10/kb5020276-netjoin-domain-join-hardening-changes). Use the account that created the computer object, have the administrator allow the reuse, or choose another computer name. Foundry does not delete or recreate the existing account. | +| `ComputerNameMismatch` | The expected computer name could not be applied. | Check the computer name set by machine naming or by the custom answer file. | +| `CredentialUnavailable` or `ContextMismatch` | The prepared credentials could not be read, or were not made for this domain. | Deploy the computer again. If it repeats on Zero-touch media, create the media again. | + +Foundry never repeats a failed join by itself, so a wrong password cannot lock the account. After fixing the cause, either deploy the computer again or join it manually in Windows, from **Settings > Accounts > Access work or school** or with `Add-Computer`. + +## Joined but the OU is wrong or unverified + +The console line and the result file report the join and the placement in the OU separately. A successful join still restarts Windows and is checked even when the placement fails. + +| Console message | Meaning | What to do | +| --- | --- | --- | +| Domain joined in the default location; target OU not found | The OU does not exist in the directory (`OrganizationalUnitNotFound`). | Correct the OU in Foundry OSD for future media, and have the administrator move the computer account. | +| Domain joined; target OU placement failed | The account could not be created in or moved to the OU, usually for lack of permission on that OU. | Have the administrator check the join account's permissions on the OU and move the computer account. | +| Domain joined; target OU placement not confirmed | The move was requested but Foundry could not read the result back. | Have the administrator check where the computer account is. | + +An existing computer account is moved only when Foundry can confirm it is the same computer object; otherwise it is left in place and the placement is reported. Without an OU, an existing account is never moved. Being a member of the domain does not prove that the account is in the intended OU. + +## Interrupted work or restart is pending + +If the computer loses power or the join takes longer than five minutes, the console shows **Domain join outcome unknown; membership is checked after restart**. The directory may or may not have been changed, so Foundry does not try the join again. + +- Keep power and network connected until Windows has restarted and setup has finished. +- After the restart, look at **Membership**. **Succeeded** means the computer is in the domain; check the OU with the administrator. Otherwise join the computer manually or deploy it again. +- Do not restart the computer by hand to make the warning disappear. + +## Credential cleanup remains Pending + +During the join, the account and password are kept in a temporary file, readable only by SYSTEM and administrators: + +`%SystemRoot%\Temp\Foundry\Payloads\DomainJoin\\credentials.bin` + +Foundry deletes it as soon as the join has used it; the console then shows **Cleanup: Disposed**. **Cleanup: Pending** means the file could not be deleted yet, for example because the join was interrupted. Foundry tries again at the next start. + +If it is still pending when setup has finished, have an administrator delete that folder once the computer is no longer running any Foundry action. Never open, copy or attach this file to a support request: it contains the join password. + +## Ask for help + +Collect the result file and the log listed in [Domain Join evidence](logs-and-support.md#domain-join-evidence). They contain no account or password, but they do contain the domain, computer and OU names; remove them if they are sensitive. diff --git a/troubleshooting/logs-and-support.md b/troubleshooting/logs-and-support.md index bbc978b..2d857be 100644 --- a/troubleshooting/logs-and-support.md +++ b/troubleshooting/logs-and-support.md @@ -8,6 +8,8 @@ In **Settings > General**, use **Export diagnostics** to save a sanitized archiv Use **Advanced: export raw logs** only when requested by a trusted support contact, and review the sensitive-data warning before sharing the archive. See [Export diagnostics](../foundry-osd/settings.md#export-diagnostics). +For Domain Join, recognized credential values are masked in sanitized logs, and a file named `credentials.bin` is never read or included, in sanitized and raw exports alike. The export still collects only the desktop application's top-level `Foundry*.log` files, not the files written on deployed computers. A secret that Foundry cannot recognize is not masked. + Remote diagnostics supplement local logs and support archives. Keep local evidence when investigating a failure: remote delivery can have gaps, and external-tool log files are not automatically uploaded. See [Telemetry and privacy](../reference/telemetry-and-privacy.md#remote-error-diagnostics). ## Find application logs in PostHog @@ -38,6 +40,7 @@ If records are missing, check consent, application version, network access, the - Selected Windows release, edition, language, and architecture. - Selected driver pack. - Autopilot method, without credentials or tenant secrets. +- For Domain Join, the states of the join, placement, membership, restart and cleanup, with the `failureCode` and the numeric error codes. Do not include accounts, passwords or other directory details. ## Windows PE log location @@ -121,3 +124,19 @@ For [Post-installation](../foundry-osd/customization/post-installation.md), coll | Execution results and saved progress | `%SystemRoot%\Temp\Foundry\State\PreOobe`, including `execution-result.json` | Desktop diagnostic export does not automatically collect target-machine logs. PostInstall does not send a separate remote telemetry stream. Review raw script output and installer logs before sharing them; they may contain secrets that automatic masking cannot remove reliably. + +## Domain Join evidence + +When the join was prepared by Deploy, collect these files from the deployed computer: + +| Evidence | Location | +| --- | --- | +| Outcome of the join | `%SystemRoot%\Temp\Foundry\State\PreOobe\domain-join-result.json` | +| Progress of all post-installation actions | `%SystemRoot%\Temp\Foundry\State\PreOobe\execution-result.json` | +| Post-installation log | `%SystemRoot%\Temp\Foundry\Logs\PreOobe\Foundry.PostInstall.log` and its rotated files | + +The result file contains the expected domain, computer name and OU, the state of each part of the join, a reason for each failure and numeric error codes. It contains no account, no password and no free-form error text. Remove the names before sharing if they are sensitive. + +If Deploy skipped the join because of the Windows edition or the image, these files do not exist: collect the deployment summary and the deployment logs instead. See [Domain Join troubleshooting](domain-join.md). + +Never attach `%SystemRoot%\Temp\Foundry\Payloads\DomainJoin\\credentials.bin`: it contains the join account and password. Foundry does not collect files from deployed computers by itself.