3 ms·
> preseed files to automate the install, domain join, Genuine question, wouldn't that require a kerberos ticket to work? Or at least some high privilege passwo
by xorcist 6y ago
> preseed files to automate the install, domain join,
Genuine question, wouldn't that require a kerberos ticket to work? Or at least some high privilege password that you might not want to keep around your preseed files? Bootstrapping trust is a tricky problem. Most that I've seen tend to go with some custom solution.
- Spivak 6y agoYes, but you can really tighten that privilege in practice. Yes having the ability to create computers in AD is potentially dangerous but in our deployments all the "AD Join Account" can do is create, delete, and reset computer passwords in one specific OU that new computers are moved out of once provisioned. We don't broadcast the join password and rotate it every so often but we also don't really care if it gets out.
- x86_64Ubuntu 6y agoHmm, I ran into the same issue too whereby I had a manual step to join the computer to the domain. I only had one computer to join, so I couldn't use anything like a real secrets solution, but I also didn't want the password to be in the Ansible files. Having an OU that computers are provisioned in, and then moved out of later on would have help me a lot.
- merb 6y agowith azure ad (even hybrid) you can let your oem make a oem autopilot domain join, thus it will be registered even bevore you have the device.