feat(domain-join): add interactive and zero-touch domain joining

[mchave3]

Summary

Add on-premises Active Directory domain joining to Foundry: an Interactive mode where the technician enters credentials during deployment, and a Zero-touch mode where the media carries protected credentials. One media can serve several domains, each with its own organizational units (OUs) and join account, and both modes can place the computer in a chosen OU.

Reason

Issue #218 asks for domain joining from shared deployment media. The join runs online in installed Windows, before OOBE, so one USB serves any computer without preparing a package per device. This replaces the offline domain join approach first proposed in the issue.

Main changes

• Foundry OSD: add a Domain Join section with Zero-touch and Interactive pages. Each lists the domains the media can join and, per domain, an optional list of OUs added through a dialog or imported from that domain through a picker, with a default domain and a default OU per domain. Listing several domains, or several OUs for a domain, makes the technician choose among them during deployment, with the default preselected; a single listed OU is always used. The lists are driven by command bars, and an OU display name can be edited. Join passwords stay with their account when the mode changes or joining is disabled. Zero-touch also stores a shared join account and optional dedicated accounts per domain, protected by the deployment password of the General page's password protection.
• Provisioning modes: only one Autopilot or Domain Join mode can be enabled. All five pages share one confirmation that names the current and the requested mode.
• Foundry Deploy: add a Domain join wizard step, shown before the summary when the technician has credentials to enter or a domain or OU to choose, and a matching summary category. Stage the input for installed Windows with access restricted to SYSTEM and Administrators. The debug menu offers Interactive and Zero-touch scenarios.
• Foundry PostInstall: wait for the directory to become reachable, join with NetJoinDomain, then move an existing computer account to the chosen OU while preserving its identity. Joining, OU placement, membership, restart and credential cleanup are tracked separately.
• Failure behavior: a failed join or placement is reported as a warning and Windows installation continues. An interrupted or uncertain join or move is never replayed. A join target must be an organizational unit; if it no longer exists at join time, the computer is joined in the domain's default location and placement is reported as failed.
• Diagnostics: exclude the credential payload from support bundles and mask quoted and escaped secret forms in logs.
• Tables: every table in Foundry OSD (domains, OUs, Autopilot profiles, tenant readiness, certificates, custom images and their indexes, post-installation actions) now spans its card with proportional columns. All of them can be sorted from their headers except the post-installation table, which keeps its execution order.
• OOBE: when a join is staged with the generated answer file, hide the Microsoft account sign-in, and let PostInstall skip the account creation page once it has verified the domain membership, so setup ends on the sign-in screen without any local account. A failed or unverified join keeps that page.
• Telemetry: report Domain Join usage on the existing osd:boot_media_finished and deploy:session_finished events (mode, domain and OU counts, default OU, shared account use, origin of the chosen domain and OU, staging status). No domain, account, OU or computer name is sent; the join outcome in installed Windows is not reported.
• Localization: translate every Domain Join string in all 38 supported cultures, with en-US as the reference. Correct the General page title in fifteen cultures where it was mistranslated; that defect predates this pull request.

Testing

• .\scripts\Test-FoundryFormat.ps1
• x64 Release build and relevant tests
• ARM64 Release build and relevant tests, when relevant
• Manual validation

Results on x64: format check 78/78; full solution Release build with CI flags and warnings as errors, zero warnings and errors; all eight suites, 4,508 passed of 4,515, with the seven existing explicit network cases (two Bootstrap, five Deploy) not run. Two tests are removed, NegotiatedChildAcknowledgementUsesActualLaunchIdentity (Bootstrap) and AcquireAsync_AnotherProcessLeasePreventsAcquisition (Core): each starts a real powershell.exe child under a 10 to 15-second deadline and timed out on a slow ARM64 runner, on code this pull request does not touch.

Manual validation, by the maintainer in a disposable AD lab on an x64 virtual machine (Windows 11 Pro):

• An Interactive join end to end, with the account and password typed on the Deploy step.
• A Zero-touch join, ending on the Windows sign-in screen without any local account.
• A join with a wrong password: reported as a warning, not retried, and setup ends on the account creation page.
• The technician choice among several domains and among several OUs on the Deploy step.
• A reused computer account.
• In Foundry OSD: the OU rename, the passwords kept across a mode change, and the full-width tables.

Validation not run and reason:

• ARM64: not built or run locally; left to CI. No physical ARM64 device was available.
• Second domain: the lab has one domain, so a real two-domain join and the OU import against a second trusted domain are covered by unit tests only.
• Missing OU, restart and recovery: the path where the target OU no longer exists, and recovery after an interrupted join, are covered by unit tests only.
• Translations: checked against en-US by a second automated pass, not by native speakers.

Additional information

• Closes [Feature]: Add local Active Directory domain join support #218
• Breaking or schema changes: Foundry authoring schema 18 and Deploy schema 16, each one above the latest published release (v26.10.7.1 ships 17 and 15). Connect schema stays 5. PostInstall JSON schemas and runtime contract stay 1.
• Screenshots or recordings: none attached yet.
• Follow-up work: documentation in docs: document domain join workflows GitBook#42.

🤖 Generated with Claude Code