{"id":327,"date":"2020-08-12T18:40:20","date_gmt":"2020-08-12T18:40:20","guid":{"rendered":"http:\/\/172.23.1.43\/?p=327"},"modified":"2022-06-07T22:25:58","modified_gmt":"2022-06-07T22:25:58","slug":"windows-10-join-method-overview","status":"publish","type":"post","link":"https:\/\/blog.n-dol.org\/2020\/08\/12\/windows-10-join-method-overview\/","title":{"rendered":"Windows 10 Join Method Overview"},"content":{"rendered":"\n

In the past on Windows, you had 2 options: Domain join or Workgroup.
Windows 10 add more options which can be done together and some other not.
We’re going to detail, what are each options, there is plenty of article and documentation on how to achieve each of them.
We’re also excluding the consumer option which is Microsoft Account join which is more or less an Azure AD join machine except that it use a Microsoft Consumer account and endpoints.<\/p>\n\n\n\n

Provisioning<\/h2>\n\n\n\n

As we are going see, there is multiple provisioning method to join machines to Active Directory or Azure AD.
The end result in both cases is the same so machines are identical no matter which joining method is used. E.g: an Offline joined and an Online joined machines are identical, it’s just a different joining process.<\/p>\n\n\n\n

Active Directory<\/h2>\n\n\n\n

Active Directory is more than 20 years old (previewed in 1999) even with that age, it is, still, the most used directory service to join Windows Machines and manage them with GPOs or now CSPs.<\/p>\n\n\n\n

Online Domain Join<\/h3>\n\n\n\n

This is the usual “Domain Join” that everybody does when joining a machine to a domain, it requires admin right on the local machine and on the domain.<\/p>\n\n\n\n

Sequence<\/h4>\n\n\n\n
  1. Admin enter the username and password allowing domain join.<\/li>
  2. Communication between the domain controller and the machine<\/li>
  3. Reboot<\/li>
  4. User can logon with a domain account.<\/li><\/ol>\n\n\n\n

    Fun fact:<\/strong> Standard users by default can join up to 5 machines themselves to Active Directory (can be changed).<\/p>\n\n\n\n

    Offline Domain Join<\/h3>\n\n\n\n

    Introduced with Windows Server 2008R2 and Windows 7, Offline domain join allow a machine to join the domain without the need to be on the network.<\/p>\n\n\n\n

    Sequence<\/h4>\n\n\n\n

    There is 2 way to execute this sequence. The first one is manually running the commands. The second one is using Autopilot and do the domain join over the air but this requires a MDM server.<\/p>\n\n\n\n

    1. Administrator\/Autopilot generate a text file which contains a base64 blob with djoin \/provision<\/code><\/li>
    2. Copy the text file onto the machine<\/li>
    3. Run djoin \/requestODJ<\/code><\/li>
    4. Reboot<\/li><\/ol>\n\n\n\n

      For the user first logon, the machine needs to have a line of sight with a domain controller, this can be on the corp network or via VPN. For VPN, you need to have a VPN capable to be triggered at the user logon interface also called GINA sometimes (historic reason it was the name of the DLL in Windows XP doing the user logon, now replaced with the Windows Credential Provider since Vista).
      After the first user logon, credentials are cached and a traditional user VPN can be used.<\/p>\n\n\n\n

      Djoin Command Line Reference: https:\/\/docs.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-server-2012-R2-and-2012\/ff793312(v=ws.11)<\/a><\/p>\n\n\n\n

      Azure AD<\/h2>\n\n\n\n

      When Microsoft started to create the cloud as we know now, it was mainly an online offering for communication product also known as BPOS (Business Productivity Online Suite), (there’s more history before but archaeology is not the purpose of this post ;), now known as Office 365, this was relying on some back end to sync up users with DirSync, now known as Azure AD Sync, then in 2012\/2013 came Azure AD as we know now.<\/p>\n\n\n\n

      Azure AD Registered<\/h3>\n\n\n\n

      Registration is a form of being part of Azure AD without impacting the machine side.
      Works on different type of devices: Windows 10 (any edition Home included), iOS Android and MacOS.<\/p>\n\n\n\n

      The machine can be domain joined, workgroup or consumer joined, so the user logon aspect does not change however for any authentication to the corporate Azure AD the registration will be used.<\/p>\n\n\n\n

      Finally, a MAM or a MDM configuration can comes down, if necessary, to protect corporate data.<\/p>\n\n\n\n

      Sequence<\/h4>\n\n\n\n