[RESOLVED] OS Domain Junction Code 1326

[bruno67]

Good morning,

After following the webinar, I tested a Windows 10 Pro deployment and I get this error on both a VM and a PC:

pb-join.png (50.03 KB) Viewed 7899 times

Nothing under c:\windows\temp\joi-......

I tried creating the computer account in the OU, but it didn't change anything. The PC doesn't go into deployment waiting mode

Any ideas you'd like to suggest?

THANKS

[dcardon]

Hello bruno67,

error code 1326 indicates an authentication problem. I assume you entered the correct password, so the problem lies elsewhere. In the console, the credentials are used to perform local privilege escalation to run the djoin command. There may be encoding issues during the credentials transfer for privilege escalation:
* What login format did you use? `identifier` and `identifier@mydomain.lan` work, but `MYDOMAIN\identifier` is buggy (to be fixed in a future version)?
* Does the domain have anything unusual (connection to a RODC, trust relationship, etc.)?
* Do you have an unusual special character in your password? (We've already had conversion problems between local machine encodings and UTF-8)

Best regards,

Denis

[bruno67]

Good morning,

Watching the webinar, I thought I understood that offline join didn't require entering an account and password in the XML file as long as the computer account existed in Active Directory. I must have misunderstood.

For the password, nothing special.

What I find strange is that during DJOIN, when choosing the OU, only one appears: 'test-gpo'

djoin.png (22.27 KB) Viewed 7834 times

while I have dozens of OUs above

I also used this procedure:
https://www.it-connect.fr/comment-deplo ... -wapt-2-2/

without further success

I just deleted the configuration to be applied (Win10-conf) and created a new one offline, and I get this message: "one or more required elements are empty"

Best regards
Bruno

[dcardon]

Hello bruno67,

The djoin function allows you to avoid putting the password in the unattend.xml file. The djoin is a blob that contains the client machine's join information (i.e., the machine's FQDN and its password in AD; a machine joined via djoin changes its password upon the first contact with AD, normally after the first reboot if on the corporate network).
So either we choose:

• either an unattend.xml online template and we put the login/password of an account that has the right to make the join,
  * or an unattend.xml offline/djoin template which will contain the djoin blob and which is automatically added to the xml file.

Regarding the display of OUs, it currently relies on OUs already used by workstations integrated into WAPT. We will add an option in the future to retrieve other OUs even if there is no WAPT workstation within them.

Sincerely,

Denis

[bruno67]

Not knowing where to begin with the deployment problem, which was failing to start due to random errors (1326, missing data in the configuration file, etc.), I ran a new `apt update` and, as if by magic, my first deployment started

[florian777]

I'm bringing this up again because I'm encountering the same error.




Wapt version: 2.2.1.11899 rev 2d82654e
OS: Windows 2016

[sfonteneau]

djoin is a Windows executable, so it's Windows that's returning this code.

It would be interesting to run the command directly in a command prompt to see exactly what Windows says.

Another question: is the console being launched with an account that has the rights to create a computer account in Active Directory?

Simon

[florian777]

Here is the command in different "states"

: Console launched with a local administrator account and cmd as a local administrator:


Console launched with a local administrator account and cmd as a domain administrator:


Console launched with a domain administrator account and cmd as a domain administrator:

[dcardon]

Hello,

for the first one, that's normal; djoin needs an account with domain privileges to create an account.

For the second one, there's clearly already a machine with the same name, so you need to add /reuse, otherwise it won't work.

The same goes for the third one.

Anyway, for some reason, /reuse doesn't seem very reliable in djoin.exe. We'll suggest deleting the entry before recreating it with djoin in the console; I think that will be simpler.

Regards,

Denis

[florian777]

Hello,

I tried using the /reuse option but it didn't change anything. I tried with a machine name that has never been registered in AD, but I get the same message: