docs: document domain join workflows

SUMMARY.md

@@ -17,6 +17,9 @@
     * [JSON profile](foundry-osd/autopilot/json-profile.md)
     * [Zero-touch hardware hash upload](foundry-osd/autopilot/zero-touch-hardware-hash.md)
     * [Interactive hardware hash upload](foundry-osd/autopilot/interactive-hardware-hash.md)
+  * [Domain Join](foundry-osd/domain-join/README.md)
+    * [Zero-touch Domain Join](foundry-osd/domain-join/zero-touch.md)
+    * [Interactive Domain Join](foundry-osd/domain-join/interactive.md)
   * [Windows customization](foundry-osd/customization/README.md)
     * [Operating system](foundry-osd/customization/operating-system.md)
     * [Custom Windows images](foundry-osd/customization/custom-windows-images.md)
@@ -40,12 +43,14 @@
   * [Select the target](foundry-deploy/target.md)
   * [Select Windows](foundry-deploy/operating-system.md)
   * [Select a driver pack](foundry-deploy/driver-pack.md)
+  * [Domain Join](foundry-deploy/domain-join.md)
   * [Review and deploy](foundry-deploy/review-and-deploy.md)
   * [Verify deployment](foundry-deploy/verify-deployment.md)
 * [Troubleshooting](troubleshooting/README.md)
   * [Media creation](troubleshooting/media-creation.md)
   * [Network and Foundry Connect](troubleshooting/network.md)
   * [Windows deployment](troubleshooting/deployment.md)
+  * [Domain Join](troubleshooting/domain-join.md)
   * [Windows Autopilot](troubleshooting/autopilot.md)
   * [Logs and support information](troubleshooting/logs-and-support.md)
 * [Reference](reference/README.md)

foundry-deploy/README.md

@@ -7,13 +7,16 @@ Foundry Deploy runs in Windows PE after network readiness. It guides a technicia
 - Confirm that the device is connected to power.
 - Confirm that required network services are reachable.
 - Disconnect storage devices that must not be selected accidentally.
-- Obtain the technician password when Protected deployment is enabled.
+- Obtain the technician password when Password protection is enabled.
+- For [Domain Join](domain-join.md), have the join account and its password ready when the media is Interactive, and make sure the computer will reach the domain once Windows is installed.
 
 {% hint style="danger" %}
 Deployment erases and repartitions the selected target disk. Verify the target before starting.
 {% endhint %}
 
-When Protected deployment is enabled, Foundry Deploy requests the technician password before initialization. Cancelling the prompt closes Foundry Deploy. Incorrect attempts can be retried, with a progressively longer delay of up to five seconds. If the password is lost, recreate the media in Foundry OSD.
+When Password protection is enabled, Foundry Deploy requests the technician password before initialization. Cancelling the prompt closes Foundry Deploy. Incorrect attempts can be retried, with a progressively longer delay of up to five seconds. If the password is lost, recreate the media in Foundry OSD.
+
+Zero-touch Domain Join uses the same technician password; there is no separate prompt for the domain account. Interactive Domain Join does not require Password protection.
 
 {% hint style="info" %}
 Foundry Deploy validates HTTPS server certificates. When the catalog supplies a file hash, Deploy checks downloaded files and rechecks cached files before reuse. For cached Windows images and OEM driver packs, **Checking cache...** shows the verification percentage and bytes processed. Allow extra time when using large files or slower USB drives. A cached file that fails verification is downloaded again with its own download progress; a replacement that also fails verification stops the affected step. See [download troubleshooting](../troubleshooting/deployment.md#download-fails).
@@ -27,5 +30,6 @@ Keep deployment media under your control. Packages without a catalog hash retain
 2. [Select Windows](operating-system.md).
 3. [Select a driver pack](driver-pack.md).
 4. Configure Windows Autopilot when JSON profile or zero-touch upload media requires a deployment-time choice. Interactive upload runs later during Windows OOBE and does not add this wizard step.
-5. [Review and deploy](review-and-deploy.md).
-6. [Verify deployment](verify-deployment.md).
+5. Complete the [Domain join step](domain-join.md#complete-the-domain-join-step) when the wizard shows it. It appears before the summary when there is a domain account to enter, or a domain or an OU to choose.
+6. [Review and deploy](review-and-deploy.md).
+7. [Verify deployment](verify-deployment.md).

foundry-deploy/domain-join.md

@@ -0,0 +1,97 @@
+# Domain Join during deployment
+
+This page is for the technician who deploys a computer with media configured for [Interactive](../foundry-osd/domain-join/interactive.md) or [Zero-touch](../foundry-osd/domain-join/zero-touch.md) Domain Join.
+
+The wizard only collects what the join needs. The join itself runs later, in installed Windows, and needs the domain to be reachable at that moment.
+
+## Before you start
+
+- Know which domain and OU the computer belongs to, and its computer name. For Interactive media, also have the join account and its password.
+- Confirm the [target disk and computer name](target.md). The computer name identifies the computer account in the domain, so check it carefully when a machine is redeployed under the same name.
+- Select the intended Windows image and edition. Windows Home editions cannot join a domain: the wizard skips the step and the summary says so, while the installation continues.
+
+## Complete the Domain join step
+
+The **Domain join** step sits between **Drivers** and **Summary**. It appears only when there is something to enter or choose, and **Next** stays unavailable until the entries are valid.
+
+**Domain name**
+
+| Media | What you do |
+| --- | --- |
+| Several domains listed | Choose the domain. The default is preselected. |
+| One domain listed | Nothing. The domain is shown and cannot be changed. |
+| Interactive media with no domain listed | Type the domain name, such as `corp.contoso.com`. |
+
+**Account and password**
+
+| Media | What you do |
+| --- | --- |
+| Interactive | Enter the **Account**, as `DOMAIN\user` or `user@domain`, and its **Password**. Changing the domain keeps what you typed. |
+| Zero-touch | Nothing. The media carries the account, unlocked by the technician password you entered at startup. |
+
+**Organizational unit**
+
+| OUs listed for the chosen domain | What you do |
+| --- | --- |
+| Several | Choose the **Organizational unit**. The default, if there is one, is preselected; **Next** requires a choice. |
+| One | Nothing. That OU is used. |
+| None, Interactive media | Optionally enter **OU distinguished name (optional)**, starting with `OU=` and inside that domain. Leave it empty to use the domain's default location. |
+| None, Zero-touch media | Nothing. The domain's default location is used. |
+
+Changing the domain replaces the OU choices with those of the new domain.
+
+{% hint style="info" %}
+The wizard does not contact the domain. A mistyped account or password is accepted here and only shows later, in installed Windows, as a failed join.
+{% endhint %}
+
+<figure>
+  <img src="../.gitbook/assets/foundry-deploy-domain-join-01-interactive-ou.png" alt="Domain join step of Foundry Deploy on Interactive media with the domain list, empty account and password fields and the OU list">
+  <figcaption>Interactive media: choose the domain, enter the join account and its password, then choose the OU.</figcaption>
+</figure>
+
+<figure>
+  <img src="../.gitbook/assets/foundry-deploy-domain-join-02-zero-touch-ou.png" alt="Domain join step of Foundry Deploy on Zero-touch media with the domain list and the OU list only">
+  <figcaption>Zero-touch media: only the domain and the OU are left to choose.</figcaption>
+</figure>
+
+## Review and start
+
+On **Summary**, the **Domain join** category shows the domain and the OU the join will use; choose its edit action to return to the step. The account and the password are never shown, neither here nor in **Confirm disk erase**.
+
+When the deployment ends successfully in WinPE, the join has been prepared, not yet performed.
+
+## What happens in Windows
+
+After the restart, during Windows setup and before the first sign-in, a Foundry console shows the post-installation actions. The join runs after drivers and network settings are applied:
+
+1. Foundry waits until a domain controller answers, for up to two minutes.
+2. It joins the computer to the domain with the join account. A refused account or password is not retried, so the account cannot be locked out.
+3. If an OU applies, the computer account is created in that OU. An account that already exists under the same name is reused and moved to the OU, without being deleted.
+4. When the join succeeds, Windows restarts once. Foundry then checks that the computer is a member of the expected domain under the expected name.
+
+The console summarizes the outcome on one line, for example:
+
+`Domain - Join: Succeeded; Placement: Succeeded; Membership: Succeeded; Restart: Completed; Cleanup: Disposed`
+
+| Part | Meaning |
+| --- | --- |
+| Join | The computer was added to the domain. |
+| Placement | The computer account is in the intended OU. **Skipped** when no OU applies. |
+| Membership | After the restart, Windows confirms it belongs to the expected domain. |
+| Restart | The restart required by the join. |
+| Cleanup | The temporary copy of the join credentials was deleted (**Disposed**). |
+
+A failed join or placement does not stop the installation: the remaining actions run and Windows setup continues.
+
+## What you see at the end
+
+| Outcome | First screen |
+| --- | --- |
+| The join is confirmed | The Windows sign-in screen. Sign in with a domain account. No local account is needed; add one on the [OOBE page](../foundry-osd/customization/oobe.md) of Foundry OSD if you want local access. |
+| The join failed or could not be confirmed | Windows asks **Who's going to use this device?** Create a local account to reach the desktop, then see [Domain Join troubleshooting](../troubleshooting/domain-join.md). |
+
+With a [custom answer file](../foundry-osd/customization/unattend.md), that file decides which setup screens and accounts appear; Foundry does not change them.
+
+## Before handing over the computer
+
+Check [deployment verification](verify-deployment.md#domain-join): sign in with a domain account, and confirm with your Active Directory administrator that the computer account is in the intended OU. If the console reported anything other than **Succeeded** for the join, the placement or the membership, see [Domain Join troubleshooting](../troubleshooting/domain-join.md).

foundry-deploy/review-and-deploy.md

@@ -11,6 +11,7 @@ Confirm:
 - Driver pack.
 - Firmware options.
 - Windows Autopilot method and, for zero-touch hardware hash upload, the configured group tag.
+- Domain Join: the domain and the OU the computer will join.
 - Optional features and other deployment customization.
 
 <figure>
@@ -24,6 +25,8 @@ When the media includes [custom answer files](../foundry-osd/customization/unatt
 
 Start only when every value is correct. Foundry opens **Confirm disk erase** before crossing the destructive boundary. Verify the disk number, model, bus, size, and selected operating system before accepting.
 
+The [Domain join step](domain-join.md#complete-the-domain-join-step) comes before the summary. The summary's **Domain join** category shows the domain and the OU the join will use, or says that the selected Windows edition cannot join a domain. The account and the password are never shown.
+
 {% hint style="danger" %}
 Accepting the confirmation allows Foundry to clean and repartition the selected disk. Existing data on that disk will be lost.
 {% endhint %}
@@ -76,3 +79,5 @@ For [custom images](../foundry-osd/customization/custom-windows-images.md), veri
 ## Post-installation preparation
 
 Foundry checks required [Post-installation](../foundry-osd/customization/post-installation.md) content and its runtime before preparing the target disk. When actions use imported scripts or packages, keep the complete ISO or USB media available until staging finishes. If this check fails, see [Post-installation preparation fails](../troubleshooting/deployment.md#post-installation-preparation-fails). Successful staging does not prove first-boot actions succeeded; continue through [deployment verification](verify-deployment.md).
+
+For Domain Join, a successful deployment means the join has been prepared; it runs after the restart, in installed Windows. When the Windows edition or the image is not compatible, Foundry skips the join with a warning in the summary and the installation continues. Check the outcome as described in [Domain Join during deployment](domain-join.md#what-happens-in-windows).

foundry-deploy/target.md

@@ -12,6 +12,8 @@ When the media enables custom answer files, choose one in **Answer file** or sel
 
 Review the selected file in the summary and confirmation. Missing files, an invalid default, architecture mismatches, and known Autopilot conflicts can block deployment. Foundry does not silently switch to native settings. See [custom answer-file preparation and compatibility](../foundry-osd/customization/unattend.md).
 
+For [Domain Join](domain-join.md) with a custom answer file, the file must set exactly one fixed computer name in its `specialize` pass and must not contain a `Microsoft-Windows-UnattendedJoin` component. Foundry uses the name from the file and does not replace a missing or `*` name with the one shown in the wizard. Correct the file before starting.
+
 ## Set the computer name
 
 The following naming rules apply when using native Foundry settings.

foundry-deploy/verify-deployment.md

@@ -36,6 +36,12 @@ When using [Post-installation](../foundry-osd/customization/post-installation.md
 
 Verify that the installed applications work after cleanup. If they need source files for repair or updates, confirm that those files remain available. Keep the [PostInstall results and logs](../troubleshooting/logs-and-support.md#postinstall-diagnostics) when investigating a problem.
 
+## Domain Join
+
+A successful deployment only means the join was prepared. After the restart, check the line that starts with `Domain -` in the Foundry console, then sign in with a domain account. Being a member of the domain does not prove that the computer account is in the intended OU: confirm it with your Active Directory administrator.
+
+When the join, the placement or the membership is not **Succeeded**, or when **Cleanup** stays **Pending**, resolve it before handing over the computer; see [Domain Join troubleshooting](../troubleshooting/domain-join.md). If Deploy skipped the join because of the Windows edition or the image, only the deployment summary mentions it.
+
 ## Automatic Windows activation
 
 For standard RETAIL deployments of supported Windows Home and Pro editions, Foundry automatically attempts to activate Windows after reboot using a compatible OEM product key stored in the device firmware. Online activation requires Internet access and a valid key for the installed Windows edition.

foundry-osd/README.md

@@ -7,7 +7,7 @@ Foundry OSD is the Windows desktop application used to prepare deployment media.
 1. Validate [Windows ADK and Windows PE](adk.md).
 2. Review [general configuration](general.md).
 3. Configure [network access](network/README.md) when required.
-4. Choose a [Windows Autopilot](autopilot/README.md) method when required.
+4. Choose a [Windows Autopilot](autopilot/README.md) method or [Domain Join](domain-join/README.md) when required. Only one provisioning mode can be active.
 5. Select [Windows customization](customization/README.md) options.
 6. [Create deployment media](media/README.md).
 

foundry-osd/autopilot/README.md

@@ -2,6 +2,8 @@
 
 Foundry supports three Autopilot workflows. Choose the method that matches the organization’s provisioning and security model.
 
+[Domain Join](../domain-join/README.md) is the alternative to Windows Autopilot. Enabling it replaces the active Autopilot mode, and enabling an Autopilot mode replaces Domain Join; Foundry asks for confirmation. Create the media again after switching.
+
 ## Choose a method
 
 ### JSON profile

foundry-osd/autopilot/json-profile.md

@@ -19,12 +19,12 @@ All profiles retained in Foundry OSD are included in media created for the JSON
 
 ## Protect the profile on deployment media
 
-Enable **Protected deployment** from [General configuration](../general.md) before creating the media when the retained Autopilot profiles must not remain readable on the ISO or USB drive.
+Enable **Password protection** from [General configuration](../general.md) before creating the media when the retained Autopilot profiles must not remain readable on the ISO or USB drive.
 
 When protection is enabled, Foundry stores every retained profile on the deployment media using AES-256-GCM encryption. Readable JSON files are not stored alongside the encrypted profiles. Foundry Deploy asks for the technician password, unlocks the deployment key, and decrypts the selected profile before staging it in the Windows installation.
 
 {% hint style="warning" %}
-Without Protected deployment, every retained Autopilot JSON profile is stored in readable form on the deployment media. Restrict access to the ISO or USB drive and recreate the media if it is lost or copied without authorization.
+Without Password protection, every retained Autopilot JSON profile is stored in readable form on the deployment media. Restrict access to the ISO or USB drive and recreate the media if it is lost or copied without authorization.
 {% endhint %}
 
 ## Expected result

foundry-osd/autopilot/zero-touch-hardware-hash.md

@@ -88,9 +88,9 @@ Use a dedicated application registration for Foundry deployment media. Do not re
 
 Foundry places the certificate PFX and its PFX password in the deployment configuration. Both values are encrypted with AES-256-GCM, which also detects whether the encrypted data has been modified.
 
-Enable **Protected deployment** from [General configuration](../general.md) before creating the media.
+Enable **Password protection** from [General configuration](../general.md) before creating the media.
 
-Foundry generates a random 256-bit deployment key for each media-creation operation. When Protected deployment is enabled:
+Foundry generates a random 256-bit deployment key for each media-creation operation. When Password protection is enabled:
 
 1. Foundry derives a key from the deployment password using PBKDF2-HMAC-SHA-256, 600,000 iterations, and a random 128-bit salt.
 2. The password-derived key protects the random deployment key with AES-256-GCM.
@@ -102,10 +102,10 @@ AES-GCM uses a unique 96-bit nonce and a 128-bit authentication tag for each enc
 A copied ISO or USB drive therefore cannot reveal the PFX private key through the stored deployment key alone; the deployment password must also be obtained or recovered. This protection no longer applies after an authorized technician unlocks the media and Foundry Deploy starts using the credential.
 
 {% hint style="warning" %}
-Protected deployment does not encrypt the entire ISO, USB drive, or Windows installation content. It protects access to Foundry Deploy and the deployment secrets stored in its configuration.
+Password protection does not encrypt the entire ISO, USB drive, or Windows installation content. It protects access to Foundry Deploy and the deployment secrets stored in its configuration.
 {% endhint %}
 
-If Protected deployment is disabled, the PFX and its password remain encrypted, but the deployment key is stored on the media so that deployment can start without a password. Anyone who obtains the media must therefore be treated as having access to its embedded deployment credentials.
+If Password protection is disabled, the PFX and its password remain encrypted, but the deployment key is stored on the media so that deployment can start without a password. Anyone who obtains the media must therefore be treated as having access to its embedded deployment credentials.
 
 Use a unique password of at least 12 characters for deployment media. Foundry accepts passwords from 8 characters, but warns when fewer than 12 characters are used. The password is not stored on the media. If it is lost, recreate the media.