Domain Join during Instance Deployment with Windows Server issue

[jamgwert81]

I have configured the follwoing in Network -> Domains for my Active Directory domain

I've entered the Domain Name, Checked the box for Join Domain Controller, entered a domain user that has join rights, and the correct password.

When I Provision a new Instance, I'm setting the name of the instance to the name of the new server (server2 in this example):

On the Advanced Options dropdown under Domain I am selecting the correct Domain I configured above during my instance deployment which is a deployment from a sysprepped Windows Server 2022 template, that works just fine without the domain join function.

During the deployment it's supposed to rename the server to the same name I entered during the Instance deployment, but it appears that it's doing the domain join step BEFORE it renames the server.  This then creates an issue after it finally boots, as the server is renamed to the Instance name (server2 in this example), however it's already been joined to the domain under the random name Windows picks on new installs.

Because of this I'm unable to even login as there is not a record for the correct computer account name in AD.  The new server appears to be joined to the domain based on the default login location, and it does in fact have the name of SERVER2.

To me it seems the domain join part of whatever is in the coding is doing it in the wrong spot.

Is this a bug?  I feel like I've configured this correctly based on the documentation in the manual.

If I've done something incorrectly with the setup of this fuction, can someone please clue me in to what I need to change or do differently?

Renaming the newly deployed servers to the name you chose during deployment, and then also doing a Domain Join seems like a pretty basic VM deployment process that should be able to work out of box.

Thanks in advance.

[bishop513]

Hi, for your virtual image do you have "SYSPREPPED / GENERALIZED IMAGE ?' checked. If so is you source image sysprepped. I am able to get the machine to rename but it will not join the domain. When the machine builds it should mount a cd-rom with a unattend.xml file that contains the details of the server name. 

[jamgwert81]

I'll have to check that setting on the template, I want to say yes it is.  The image is syspreped with the Generalize option before it's powered off and turned into a template. 

Again the rename part works fine if it's done without the Domain Join stuff.  The problem is doing the rename AND the domain join.  To me it seems like it's doing the Add-Computer domain powershell first, not rebooting, then doing a Rename-Computer -NewName which then makes AD not be aware of the new name as you renamed the local computer name AFTER you joined it to the domain.   

My understanding if you are going to do a Rename and Domain Join at the same time the powershell behind it needs to be something like the following.

Add-Computer (Microsoft.PowerShell.Management) - PowerShell | Microsoft Learn

[bishop513]

You want to confirm the Enabled Sysprep is check as per -> Configuring Virtual Images | HPE Morpheus Enterprise Software Documentation v8.0.13
After finally getting my rename and domain join to work, I became apparent to me machine naming and domain join are handled as 2 seperate steps. The machine rename is done when the VM is deploy and first booted up via the unattend.xml. If you have sysprep setup correctly you should see the newly provisioned VM has a CD-ROM \ ISO attached to it. I would inspect the xml file and make sure your machine name details are included.  Once this is done the machine is joined to the domain by morpheus injecting a domain join script, as a seperate step. 

If you want to see the script you will need to increase the log level logback config | HPE Morpheus Enterprise Software Documentation v8.0.13 and you will want to bump up the logging for <logger name="com.morpheus.os.WindowsOsService" level="INFO"/>. I bumped mine up to TRACE. WARNING: it is going to expose your domain password in a base64 string.

[jamgwert81]

Enabled Sysprep? is a setting that is only present on the following types of images for these specific clusters it appears:

This setting is not valid or available on an HVM cluster Virtual Image it appears. 

I feel the documentation link you sent is not the correct documentation for creating an HVM Windows Image template which is here:
Image Prep (Windows) | HPE Morpheus Enterprise Software Documentation v8.0.13

I followed this to the T with the exception of "winrm quickconfig" which shouldn't cause the issue I'm seeing.

I did ensure that all of the following are checked on the HVM virtual image.

I did do some additional testing by simply unchecking the Sysprepped \ Generalized Image? option just to see what happened.  By doing this it does the rename of the server and domain join correctly however it does not appear to be doing any of other stuff I'd expect from the unattend.xml as when the new machine boots I"m having to enter the Administrator password and accept the EULA like it is a new install.  Not as big of an issue but still super annoying it doesn't work as one would expect.

[karata]

Hello

You are having to do that because you havent passed the password parameter, thats why cloud  init does not use the unattended confirmation

Here is what you have to do:  

Go in the unattend.xml, just outside of the configutatio tab. out of the OOBE add as shown:

<Conf.....>

<OOBE>..........................</OOBE>

<UserAccounts>

<AdministratorPassword>

<PlainText>true</PlainText>

<Value>YourPassword</Value>

</AdministratorPassword>

</UserAccounts>

The go to services.  for windows 2025 the cloud init service shoulf have Automation Startup for WIndows 2019 and below put Start tyoe Automatic (delayed start)

Kudos............. Hope this helps

[karata]

also do this Do not click sysprep in the cloudbase init. also check the checkbox to allow cloud init  to run as a local service.

[jamgwert81]

@karata I guess I'm confused.  You're saying to update the unattend.xml manually to include the password?

To me the Syspreped/Generalized Image? being checked is making it do the sysprep step, however it's doing the domain join incorrectly if I choose to do that during Instance deployment.

If I uncehck Sysprepped/Generalized image? it does the domain join and computer rename correctly (which seems odd to me) but doesn't do the sysprep step of setting the password., even if the Username and Password are populated on the Virtual Image template. I've done this with the Username and Password fields populated on the Virtual Image template settings and it appears to pass the password correctly to the Unattend.xml file, assuming I've also checked Sysprepped/Generalized image?

To me it seems like the Sysprepped/Generalized Image? setting is working, but when you combine that setting with the domain join part it's not playing well with that setting.

Can you explain the cloud init stuff?   I didn't think doing an HVM tempalte and image that Cloud Init comes into play with deployment. 

The guide for HVM Windows Template indicates to leave all other settings that aren't listed as unchecked:



so I've made sure to unchecked both:
Is Cloud Init Enabled?
Cloud Guest Customization? - this setting states to only use it on VMware and KVM images that are not syspepped.  My image in the case is sysprepped.  I'm also not sure it even applies to an HVM cloud based on what is says.

Here is the full config of the first section of the Virtual Image settings for this template:



Under the Advanced section of the Virtual Image settings on this template I have the following:

Ive tried the Auto Join Domin? setting both unchecked and checked.  To me this has no effect as the domain join part appears to be driven off of the Instance deployment setting I oulined in my orignial post where you select the Domain during Instance deployment.

I feel like there is a major disconnect in the documentation when doing basic Windows deployments on an HVM cluster vs doing this on other cloud types (VMware, Nutanix, Hyper-V, KVM etc). which then creates confusion on how to configure it for one cloud type vs another.

[karata]

@jamgwert81 

Well.  I think it works.  so the idea behind is that most of this task can be done once the agent is installed. and only then can your operations be swift. for the agent to work the template must have cloud init ready in it. 

And also morpheus automatically syspreps an image. if its ok we can have a call and discuss about it

[jamgwert81]

@karata 

So do I need to be checking the box Is Cloud Init Enabled?

If that's the case then the documentation on both the Morpehus Enterpise and VME Essentials pages for doing this are both wrong as they say to uncheck anything that isn't listed which Is Cloud Init Enabled? is not listed:
Image Prep (Windows) | HPE Morpheus Enterprise Software Documentation v8.0.13

Image Prep (Windows) | HPE Morpheus VM Essentials Software Documentation v8.0.13

Morpehus does a sysprep by default, when is this occruing? when you select Import Image?  My understanding is that it does not automatically do this which is why the documentation in for both products above has a step that tells you that you need to manually sysprep the image before you shut it down to capture it.

As for the Agent needing to be installed. Should this be done before the sysprep?  There is nothing in the links above indicating to pre-install the Agent on the image before it is captured. 

I'm very confused at this point.

[jamgwert81]

I think you are referring to the Cloud Init image templating.  Which is outlined in this link:
Configuring Virtual Images | HPE Morpheus Enterprise Software Documentation v8.0.13

This method assumes you are installing Cloudbase-Init on your image.  This method differs from an HVM cluster image.

Below is the link for Image Prep (Windows) for creating an image for use on a HVM cluster.  This does not leverage Cloudbase-init, and is entirely different.  This is also the method I am using to do my deployments of the image I created from this guidance.  This method works but has an issue when you combine it with a domain join from my expereince.

Image Prep (Windows) | HPE Morpheus Enterprise Software Documentation v8.0.13


I'll try this again by increasing the WindowsOS log to Trace to see if I can uncover why it doesn't work in the scenarios I've tried.

[karata]

Hello

I too struggled with the same documentation.  But my way worked. The thing is VME is a Morpheus with less features but the logic still remains the same.

We can have a call and will show you how so it is