SERVER-006 · Script
Join Windows Computer to Domain
Joins this Windows computer to a domain silently, using an offline join file or a join account.
What it does
Runs on the computer being joined, as SYSTEM or a local administrator. Two ways to join:
- Offline file: Point -BlobPath at a file made on a domain controller with djoin /provision.
No password is needed on the computer at all. Recommended.
- Join account: Set -JoinAccount (DOMAIN\name) and put the account's password in an environment
variable, for example a secure variable in your management tool. -SecretVariable is the name of that variable. The password is never written to this file or the log. If the computer is already in the domain, nothing changes. Preview mode (default) checks the settings and reports what it would do. Apply joins the domain, optionally with a new name and OU. A restart is needed to finish. By default the script does not restart; use -Restart IfNeeded.
Requirements
Windows 10, 11 or Windows Server with Windows PowerShell 5.1, run as SYSTEM or local admin. The computer must reach a domain controller (DNS pointed at the domain). Offline join needs a file from djoin /provision.
How to run it
- Run as: SYSTEM on the computer being joined
- Run from: any RMM or MDM, a scheduled task, or an elevated PowerShell window on that computer
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Secret: put the join password in the environment variable named in SecretVariable, or use an offline join file
- Timeout: 10 minutes
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| DomainName | DNS name of the domain, for example school.local. | ||
| OUPath | OU for the computer account, as a distinguished name. Leave empty for the default Computers container. | ||
| NewName | New computer name to set while joining. Leave empty to keep the current name. | ||
| BlobPath | Path to an offline domain join file from djoin /provision. When set, the join account is not used. | ||
| JoinAccount | Account allowed to join computers, as DOMAIN\name. | ||
| SecretVariable | Name of the environment variable that holds the join account password. Default: SS_JOIN_SECRET. | SS_JOIN_SECRET | |
| Restart | Never (default) or IfNeeded, which restarts 60 seconds after a successful join. | Never, IfNeeded | Never |
Exit codes
- 0 = Already joined, or Preview checks passed
- 1 = Joined; a restart is needed to finish
- 2 = Script error or join failed (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. To undo a join, sign in with a local administrator account and remove the computer from the domain (Remove-Computer), then restart, and delete the computer object in the directory if needed.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |