Adding a computer to an Active Directory Organizational Unit via "Configure Computer" or "Apply System Configuration" task

Products

• Deployment Solution

Issue/Introduction

Scenario 1:

When using a "Configure Computer" or "Apply System Configuration" task to join client computers to an Active Directory (AD), they do not correctly join when specifying one or more Organizational Units (OUs).

Symantec Agent Logs will show a failure with little or no additional information.

The NetSetup.LOG (default location: C:\Windows\debug\)

 

Scenario 2:

In 8.5 RU2 the task fails then crashes Symantec Management Agent (SMA), then SMA restarts, the task re-runs and completes successfully.

Starting from 8.5 RU3 the task fails and stops. Computer joins Domain, but doesn't move to the specified OU. After re-running the task, it completes successfully and the selected computer gets moved to the specified OU

Cause

For Scenario 1:

A specific syntax must be used when client machines are added to an OU.

 

For Scenario 2:

Also, DS uses an obsolete version of config.dll, there were some attempts made in the past to use the latest DLL, but they failed because config.dll kept crashing during the task. What happened is that the changes made to GSS during the last couple of years have fixed quite a few problems and config.dll does not crash anymore in this scenario.

Environment

Deployment Solution 7.6, 8.x

Resolution

Regarding Scenario 1:

Detailed below are a few example cases that show how to use the "Apply System Configuration" task with domain and/or OU joins in the Active Directory. For each of these cases, we will be using an Active Directory with the following structure:

domain.environment.local
└ OU 1
   └ OU 2
          └ OU 3
└ OU A

Case 1 - Joining a client machine to the root of the domain*

• In the "Apply System Configuration" task, select the radio button next to "Domain:"
• Populate the text box with the domain in the following format: domain.environment.local
• Provide the credential area with a domain account with sufficient privilieges to join the client to the domain
• Click "OK"

Case 2 - Joining a client machine to an OU that is one level deep 

• In the "Apply System Configuration" task, select the radio button next to "Domain:"
• Populate the text box next to "Domain:" with the domain in the following format: domain.environment.local
• Populate the text box next to "Organizational unit:" with the OU in the following format: OU 1
• Provide the credential area with a domain account with sufficient privilieges to join the client to the domain and specific organizational unit
• Click "OK"

Case 3 - Joining a client machine to an OU that multiple levels deep

• In the "Apply System Configuration" task, select the radio button next to "Domain:"
• Populate the text box next to "Domain:" with the domain in the following format: domain.environment.local
• Populate the text box next to "Organizational unit:" with the OU in the following format: OU 1/OU 2/OU 3
• Provide the credential area with a domain account with sufficient privilieges to join the client to the domain and specific organizational unit
• Click "OK"

 

* This can only be done to client machines that are not presently in the domain. If the client is already joined to the domain and in an organizational unit, it cannot be moved to the root of the domain again. It will instead be moved to the lowest-level organizational unit in its current path, e.g., if the client were in OU 3, it would be moved to OU 1.

 

For Scenario 2:

There is a fix for this issue with the task fails already scheduled for DS 8.6 RU1 release.

There are 2 workarounds that exist:

1. Use config.dll from the latest GSS release (currently GSS 3.3 RU7) and it should address the issue.

The files on GSS are:

"C:\Program Files (x86)\Altiris\eXpress\Deployment Server\Agents\AClient\altiris-config-<version>.X86.dll"

"C:\Program Files (x86)\Altiris\eXpress\Deployment Server\Agents\AClient\altiris-config-<version>.X64.dll"

Could be placed on DS clients at:

\Altiris Agent\Agents\Deployment\config.dll

 

These newer GSS binaries were not fully tested on DS.

Only this particular scenario is known to work.

 

OR

2. Customers can run this "Configure Computer" or "Apply System Configuration" task two times meanwhile.

The issue becomes visible in the releases 8.5 RU3 – 8.6 because SMA no longer crashes, and thus doesn’t run the task twice.