Join domain while running PowerShell as system and specifying domain join credentials

Dave

6/11/24, 5:40 PM

I have a WORKGROUP machine that I need to join to the domain. I can access PowerShell on the machine as System using the installed RMM tool. But I get an error whenever I try to Add-Computer from the System account. My thought was it should work since System is an elevated account. Other elevated functions seem to work fine.

I store my domain admin credentials in $cred then try the following:

[System.Security.Principal.WindowsIdentity]::GetCurrent().Name NT AUTHORITY\SYSTEM

Add-computer -domainname domain.com -Credential $cred -restart -force

Add-Computer: Computer 'hostname' failed to join domain 'domain.com' from its current workgroup 'WORKGROUP' with following error message:

A device attached to the system is not functioning.

Anybody got a suggestion?

229

1 + 4

powershell

active-directory

Dave

6/11/24, 5:42 PM

Side note, running PowerShell as System through the same RMM, I was able to remove the computer from the domain without issue.

Bernd Schwanenmeister

6/12/24, 7:38 AM

System accounts are not entitled to domain-joining. The fact that you can remove it from the domain does not imply that you may join it as system.

Dave

6/14/24, 1:53 AM

Well, used Powershell to add a new local admin. Turns out something else is wrong. Even logged in as Administrator I can't join the domain. The option (in control panel > System) is greyed out. This is Windows 10 Enterprise LTSC. I verified the Workstation service is running.

Bernd Schwanenmeister

6/15/24, 7:35 AM

Sounds serious. I would run an inplace upgrade for repairs now.

Score:0

Server

Jan

8/10/24, 11:06 AM

You cannot use SYSTEM account to join a computer to Active Directory. Yes the SYSTEM (also called Local System) can perform network operations contrary to Local Service, however it uses the credential of the computer object (hostname$) to authenticate against Active Directory, however in your case the object does not exist because the machine is not joined to the domain in the first place.

Now I understand you are passing the credentials of a permitted domain admin for the join operation, but the command still gets executed in SYSTEM context. My guess would be since the domain computer creates a secure channel between the computer and the domain and SYSTEM represents the computer object, it cannot fully complete the join operation as it is trying to change itself on the machine.

Another thing to take into account is if you have renamed the computer before the join operation, then you have to specify additional options in your command.

Add-Computer -DomainName domain.here -Options JoinWithNewName,AccountCreate -Credential (Get-Credential) -Restart

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Join domain while running PowerShell as system and specifying domain join credentials

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.