OSD join domain step overwrites existing computer objects without warning

Question

We're going through a huge hardware refresh, and it's come to our attention that the join domain step in the OSD task sequence will join new systems to the domain with a name that matches and old system breaking the domain trust of the old system. While the old system should have its name changed prior, or the new system prepped with a new/unique name, is there anything we can do to prevent this from happening (such as a prompt that the name already exists)? Can anyone explain why the new computer account is created when one with the same name already exists?

Answer 1

How are the new devices named and why are they being named with the same name as existing systems?

Also, which task exactly are you using? An actual Join Domain task or the Apply Network Settings task?

Answer 2

@K C

Thanks for posting in Microsoft Q&A forum.

To prevent the occurrence of joining domains with an existing name during OSD, it is suggested to query AD and determine wether the name exists in AD.
Please refer to the following steps:

1. Enable PowerShell in boot image
2. Create a package that copy’s AD module files to the boot image, and run it in task sequence
3. Create a PowerShell script to:
   ·Interact with task sequence.
   ·load PowerShell form for prompting computer name selection.
   ·Import Active Directory module, securely connect to Active Directory and check the name against Active Directory.
   ·Set computer name as OSDComputername TS variable (assuming that the name not exists).
   The PowerShell form script and other more details, please refer to the following link：
   http://idanve.blogspot.com/2017/11/verify-computer-name-against-active.html
   Note: This is not from MS, just for your reference.

Thanks for your time.

---

If the response is helpful, please click "Accept Answer"and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

This is expected behavior. Your approach of the device naming should be different that you would not have that problem. Absolutelly the best way to name device is use serial number variable, which will then generate AD hostname based on serial. MAC adress is other option. But if you wish to stick to your original naming plan, maybe try to investigate, could you limit Doman Join account to be able to only create new objects, but not write on exsting once. Than will then make your re-install of the existing device harder.

Answer 4

Automatic naming is the most common method. An alternative is to build as a Windows auto generated name (like the MININT-XXXX) and then rename to the desired name post domain join. A rename operation will fail if an existing object already exists in the domain, however if you don't prompt or something with a script then you will be left with the auto generated name.