Azure-quickstart-templates: Error with 201-vm-domain-join

[mrdenny]

201-vm-domain-join

Issue Details

When I add this to an existing JSON script (trying to replace DSC) I put the following into the script.

 {
          "apiVersion": "2015-06-15",
          "type": "Microsoft.Compute/virtualMachines/extensions",
          "name": "[concat(parameters('virtualMachines_CoreServer_name'),'/joindomain')]",
          "location": "[parameters('Location')]",
          "dependsOn": [
            "[concat('Microsoft.Compute/virtualMachines/', parameters('virtualMachines_CoreServer_name'))]"
          ],
          "properties": {
            "publisher": "Microsoft.Compute",
            "type": "JsonADDomainExtension",
            "typeHandlerVersion": "1.3",
            "autoUpgradeMinorVersion": true,
            "settings": {
              "Name": "domain.local",
              "OUPath": "CN=Computers,DC=domain,DC=local",
              "User": "[concat('domain.local\\', parameters('defaultUserName'))]",
              "Restart": "true",
              "Options": "3"
            },
            "protectedsettings": {
              "Password": "[parameters('defaultPassword')]"
            }
          }
        }

I get the following in the ADDomainExtension log.

2016-07-26T10:07:14.3726281Z [Error]: Try join: domain='domain.local', ou='CN=Computers,DC=domain,DC=local', user='[email protected]', option='NetSetupJoinDomain, NetSetupAcctCreate' (#3:User Specified), errCode='2'.
2016-07-26T10:07:29.5929818Z [Error]: Try join: domain='domain.local', ou='CN=Computers,DC=domain,DC=local', user='[email protected]', option='NetSetupJoinDomain' (#1:User Specified without NetSetupAcctCreate), errCode='1332'.

Error two is file can't be found. I can't find any information on what error 1332 is.

If I attempted to join the VM to the domain manually I am able to do so without issue. I've tried it using both username formats (domain\username and username@domain).

Any idea how to resolve this?

[mrdenny]

OK, ignore this I have having a problem with AD apparently.

[jensonjc]

Hi Denny, I am getting exactly the same error as yours when using JsonADDomainExtension with Option 3. How did you resolve the issue?

[mrdenny]

Jensonjc,
I ended up using a custom script expension combined with autologin to log into the machine then have it join the domain. The problem is that the JsonADDomainExtension runs as the local system account, and the local system account doesn't have permissions to join the machine to the domain. If you use your own template this isn't an issue as you've logged onto the machine, so the extension uses that account, but because no one has logged into the template there's no account to login with, so it bombs out. I haven't published the script that I used, but I can probably scrub the customer information from it and post it online.

[migrande]

I ran into this as well. I fixed it by using an actual OU for the OUPath parameter rather than the default computers container. The default container worked for me if the computer accounts existed in AD already, but the script couldn't create new accounts without an OU specified.

[pixelicous]

Anyone else getting to this post, just a small FYI not written anywhere, usually you do not HAVE to use protectedsettings, it appears for this you have to put the password under protctedsettings, else this will fail. I also tried using UPN instead of domain.local\username, and without any OUPath

[joulesmallett]

Hey, this error was driving me insane. Like everyone else I was able to manually use the credentials to successfully domain join to a specified OU but not via the extension.
In my case I found out that I needed to us the fully qualified user@domainName to get this to work, where previously I was just inserting the username and assuming the domain name would be appended.

[huzzeytech]

@joulesmallett this has also caused a headache for me. Do you have a sample of what worked for you? Did you end up just using a script extension?

[mrdenny]

I used a powershell script extention.

[joulesmallett]

Hi Cody,
I used the ARM extension for domain joining.

The domain name, the OU and the credentials are stored in keyvault and passed in as parameters, passed in with a param file, nothing unusual here. The copy index was here as I wanted to create multiple machines.

This was the value that caused me issues. I had to make sure the value had fully qualified [email protected][e-mail]

      "User": "[parameters('domainAdminUsername')]",

...
...
...
{
"apiVersion": "2018-06-01",
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),copyIndex(),'/JoinDomain')]",
"copy": {
"name": "vmjdextloop",
"count": 4
},
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Compute/virtualMachines', concat(parameters('vmName'),copyIndex()))]"
],
"tags": {
"displayName": "Domain Join Extension"
},
"properties": {
"publisher": "Microsoft.Compute",
"type": "JsonADDomainExtension",
"typeHandlerVersion": "1.3",
"autoUpgradeMinorVersion": true,
"settings": {
"Name": "[parameters('domainName')]",
"OUPath": "[parameters('ouPath')]",
"User": "[parameters('domainAdminUsername')]",
"Restart": "true",
"Options": "[parameters('domainJoinOptions')]"
},
"protectedSettings": {
"Password": "[parameters('domainAdminPassword')]"
}
}
},
...
...
...

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

---

JULIAN MALLETT | UK Practice Lead (Azure)
NEWSIGNATURE
Mobile: [phone]
DDI: [phone]
New Signature UK ltd.
Website | LinkedIn
Laxmi Building|
The Tanneries
57 Bermondsey Street|London|SE1 3XJ

NS1001

From: Cody [e-mail]
Sent: Monday, April 29, 2019 9:55:09 PM
To: Azure/azure-quickstart-templates
Cc: Julian Mallett; Mention
Subject: Re: [Azure/azure-quickstart-templates] Error with 201-vm-domain-join (#2272)

@joulesmalletthttps://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fjoulesmallett&data=02%7C01%7Cjulian.mallett%40newsignature.com%7Ca94defd0073a40523d6208d6cce4f7ec%7Ca1a2578a8fd34595bb187d17df8944b0%7C1%7C0%7C636921681130907646&sdata=2hxkhsqWYVVDCQ2keQrKi3WJEvtK3hYGptyxnSPD90A%3D&reserved=0 this has also caused a headache for me. Do you have a sample of what worked for you? Did you end up just using a script extension?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fazure-quickstart-templates%2Fissues%2F2272%23issuecomment-487740254&data=02%7C01%7Cjulian.mallett%40newsignature.com%7Ca94defd0073a40523d6208d6cce4f7ec%7Ca1a2578a8fd34595bb187d17df8944b0%7C1%7C0%7C636921681130917656&sdata=EBnw8t4QwLssWoBQ6XMwOVUHOwOz3CuFQu9gsaGneMw%3D&reserved=0, or mute the threadhttps://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAGG52NHEDYCYT7C3VMPS6A3PS5OC3ANCNFSM4CKUAQDQ&data=02%7C01%7Cjulian.mallett%40newsignature.com%7Ca94defd0073a40523d6208d6cce4f7ec%7Ca1a2578a8fd34595bb187d17df8944b0%7C1%7C0%7C636921681130917656&sdata=%2B%2BBg3eoHjq46xyutoIT29iJOtzOekBWBmkL%2FtIVrP1M%3D&reserved=0.

[pixelicous]

resource "azurerm_virtual_machine_extension" "domain_vm" {
  name                 = "JoinDomain"
  location             = "${var.location}"
  resource_group_name  = "${azurerm_resource_group.domain.name}"
  virtual_machine_name = "${azurerm_virtual_machine.vm.name}"
  publisher            = "Microsoft.Compute"
  type                 = "JsonADDomainExtension"
  type_handler_version = "1.3"

  #auto_upgrade_minor_version = false

  settings = <<SETTINGS
{
        "Name": "${var.DomainName}.com",
        "User": "${var.username}@${var.DomainName}.com",
        "OUPath": "",
        "Restart": "true",
        "Options": "3"
}
SETTINGS

  protected_settings = <<PROTECTED_SETTINGS
{
    "Password": "${var.userpass}"
}
PROTECTED_SETTINGS
}

[docunid]

Tried and tested:
az vm extension set \ --name JsonADDomainExtension \ --publisher Microsoft.Compute \ --version 1.3 \ --vm-name <vm-name> \ --resource-group <resource-group> \ --settings '{"Name":"<domainname>", "OUPath":"OU=<...>,DC=<...>", "User":"<...@...>", "Restart":"true", "Options":"3"}' \ --protected-settings '{"Password":"<password>"}'