Skip to content

README.md

Latest commit

 

History

History
82 lines (55 loc) · 5.44 KB

README.md

File metadata and controls

82 lines (55 loc) · 5.44 KB
Raw

Add Computer to AD Group: Kerberos and LDAPS membership automation for ConfigMgr OSD

ConfigMgr OSD Add Computer to AD Group

Add computer accounts to Active Directory groups during ConfigMgr OSD with verification, retries, compatibility modes, and CMTrace logging.

Current version: 1.0.1. The workflow publishes a prerelease candidate. Verify downloaded assets and obtain maintainer approval before promoting the candidate to a regular release marked latest; see the release process. Release status describes distribution, not platform certification. This README follows main; downloads are versioned snapshots.

Quick start | Deployment | Compatibility | Security | Troubleshooting

Version 1.0.1 CI on main pushes Windows PowerShell 5.1 MIT license

Quick start

  1. Package Scripts\Add-ComputerToADGroup.ps1 and distribute it to the required ConfigMgr distribution points.
  2. Run as Local System in full Windows, after domain join and the required restart, using Windows PowerShell 5.1. WinPE and PowerShell 7 are not supported runtimes.
  3. Immediately before the script step, create the hidden custom ConfigMgr Task Sequence variables ADGroupUserName and ADGroupPassword for a dedicated account with delegated group-membership permissions.
  4. Use a Run PowerShell Script step with Scripts\Add-ComputerToADGroup.ps1 as the script name and this value in Parameters:
-GroupName 'Workstation-Certificate-AutoEnroll'
  1. Clear both credential variables immediately afterward on success and failure, and preserve a failed script result.

The self-contained script defaults to Kerberos over LDAPS on TCP 636, with no automatic transport fallback or external runtime module dependency. It verifies direct membership and returns 0 only when all requested groups succeed; failures return 1.

Read deployment for prerequisites, cleanup handling, parameters, and log locations. Complete the environment-validation checklist before a staged rollout.

Why this project exists

A ConfigMgr Task Sequence may need to add the newly joined computer to specific Active Directory groups. This project keeps that operation in a self-contained Windows PowerShell 5.1 utility, without RSAT or external runtime modules, with explicit authentication and transport settings, membership verification, retries, and logging.

Highlights

  • Kerberos over LDAPS on TCP 636 by default, without automatic authentication or transport fallback.
  • Explicit SignedLdap transport on TCP 389 with signing and sealing.
  • Direct membership checks, with post-write verification for additions.
  • Site-aware domain controller ordering and failover, with name-order fallback when the local site is unknown.
  • Bounded retries with permanent/transient error classification.
  • CMTrace-format logs with sanitized error messages and explicit 0/1 exit codes.
  • Windows PowerShell 5.1 parser/analyzer checks, mocked Pester coverage, and a SHA-256 source manifest.

Documentation

Read the documentation site or browse the same guides here on GitHub:

Validation status

The v1.0.1 source passes Windows PowerShell 5.1 parser checks, PSScriptAnalyzer, mocked Pester tests, and exact-byte SHA-256 manifest verification. Tests cover parameter validation, LDAP requests, retry decisions, resource cleanup, logging, documentation, and validator process exits without writing to AD. Check CI for the status of a specific revision.

Live ConfigMgr and Active Directory testing was not executed for this release. Use the validation checklist to verify your environment. Windows Server 2012/2012 R2 remains best effort with WMF 5.1, not a verified platform.

Maintainer

Claudio Mendes · @vartaxe · vartaxe@outlook.com

Related projects

License

MIT. See LICENSE.