What actually happens when I join a windows machine to an Active Directory domain

active-directory

I haven't been able to find this info anywhere, and I don't really have the time to set up a AD server myself to play around with. I'm not an expert on AD so if some of my terminology is off, forgive me.

When a user tries to join a Windows (we'll say Windows 7) machine to a AD controlled domain, what actually happens? Meaning what permissions and accounts are checked by the AD server? From what I've been able to scrounge up it seems like a computer object HAS to exist in AD with the specific computer name. And then it also looks like if the current computer is in the domain, and the user is trying to change the name, then the old computer is deleted from the domain? (not sure).

I'm really asking to figure out where "joining a domain" would fail, in the process of joining a domain.

So something like: AD checks for the existence of the computer name, then checks these user permissions, then checks these attributes, etc, up to "the computer is allowed to join the domain with the specified name".

I figured this would be helpful for a lot of other people based on the number of "problems joining AD domain" threads I've found online with half-responses.

Best Answer

Assuming this is a new computer which does not map to an old computer name that was previously in the domain...

At a very high level: You supply creds in the domain join operation. On the AD side it checks to see if a computer account exists for the computer name of the machine you are joining, which in this scenario it does not. So it goes ahead and creates a new one (subject to perms & throttling on the part of the credentials supplied for the join operation). At this point the computer acct & the DC do a few operations to set key properties (not the least of which is the secret, aka the password on the computer account) & local state on the machine joining is manipulated...SIDs remembered, secrets stored, etc. At the conclusion you are told to reboot.

If the previous assumption is incorrect and a comp acct already exists, it reuses an existing computer account rather than creating a new one. But it ensures you can write a new secret to the computer acct which is required as part of domain join (which in the 99% case maps to owns the comp acct since few people have re-acl'd their computer accounts to allow just this permission).

That's what's going on at a high level anyway. :) If you want to go deep on it, enable netlogon logging and do a join, then check out the log. And if you want to go deeper still, check out the AD protocol documentation which will go VERY deep.

Related Topic