Offline Domain Join

w^rl0rd

Hi, I'm having a hard time understanding some things about Offline Domain Join and I'm hoping you guys/gals can help.

I understand how to do one but what I don't understand is - does the computer ever actually join the domain? I mean, once it get's an IP and a network connection can a user log on and access domain resources?

BornToBeMild

Basically offline domain join separates the changes to AD and the changes to the computer. That way you don't need access to AD when you run the computer join bit. After rebooting the computer is a domain member, the same as any other. You still need to be on the company network with access to a DC to get authenticated against resources, it doesn't change that requirement.

In 2012 they added the ability to include certificates and group policies to the "blob". That allows you to offline join a PC, then connect it via DirectAccess.

bohack

I just did a video on this, you can view it here https://www.youtube.com/watch?v=4OX6C_FakII. In the past I used offline domain join and security connection policies to only allow computers that could authenticate, to be allow to hit my KMS server. This way, my work at home users I didn't have to burn a MAK key on. There are hundreds of obscure reasons for offline domain joining.

lsud00d

Nice use of offline domain join bohack!

w^rl0rd

Thanks for the clarification. I understand now.