Domain join fails with 0x534 after upgrading to Deployment Solution 8.8 or 8.8.1
search cancel

Domain join fails with 0x534 after upgrading to Deployment Solution 8.8 or 8.8.1

book

Article ID: 457919

calendar_today

Updated On:

Products

IT Management Suite Client Management Suite Server Management Suite Asset Management Suite Deployment Solution

Issue/Introduction

After you upgrade IT Management Suite (ITMS) from 8.7.x to 8.8 or 8.8.1, imaging jobs fail at the domain join step. The failure happens after the computer reboots into Windows, not in WinPE (automation). The computer does not join the domain, and no computer account appears in the target (custom) organizational unit (OU). The same join account and OU delegation worked before the upgrade.

The issue occurs when all of the following are true:

  • The System Configuration settings in the job specify a destination OU.
  • The domain join account has Create Computer objects permission on the target OU only, not on the default Computers container (CN=Computers).
  • The computer has no existing account in Active Directory. New devices fail. Re-imaged devices that already have a computer account usually succeed.

The client log C:\Windows\Debug\NetSetup.log shows this status line:

NetpJoinDomain
MachineAccountOU: (NULL)
Account: <DOMAIN>\<join-account>
Options: 0x10000003
NetpGetComputerObjectDn: Got DN CN=<computer>,CN=Computers,DC=example,DC=com from the default computer container
...

Account: ad\<join-account-B>
NetpModifyComputerObjectInDs: ldap_add_s failed: 0x35 0x216d
NetpGetComputerObjectDn: Crack results:   Account does not exist
NetpDoDomainJoin: status: 0x534

Windows error text for this code:

  • 0x534: No mapping between account names and security IDs was done.

 

Symptoms

  • The imaging job fails at the domain join step after the computer reboots into Windows. WinPE tasks complete normally.
  • The computer is not joined to the domain.
  • No computer account for the device exists in the target OU or in CN=Computers.
  • Joins succeed when you pre-create the computer account in the target OU.

Log entries

In C:\Windows\Debug\NetSetup.log, the first join attempt tries to create the account in CN=Computers:

NetpJoinDomain

     MachineAccountOU: (NULL)

     Account: ####\####

     Options: 0x10000003

NetpGetComputerObjectDn: Got DN CN=####,CN=Computers,DC=example,DC=com from the default computer container

The automatic retry finds no account and fails with 0x534:

     Options: 0x10000001

NetpGetComputerObjectDn: Crack results:   Account does not exist

NetpDoDomainJoin: status: 0x534

How to read these lines:

  • MachineAccountOU: (NULL) is expected in 8.8 and 8.8.1. It does not mean the OU is misconfigured.
  • CN=Computers in the Got DN line confirms Windows is creating the account in the default container.
  • A line similar to failed to find a DC having account '####$': 0x525 is normal for a new account. Ignore it.

In DSTasks.log, the task stops at the join stage with an error. The move-to-OU stage does not appear. 

Note

Do not use the PreOS_Task_Logs folder for this issue. That folder holds automation (WinPE) logs that DS copies to the local drive after DS tasks run in automation (KB DS 8.x Automation Logs). This failure happens in production Windows.

Environment

IT Management Suite (ITMS) 8.8 and 8.8.1
Deployment Solution (DS) 8.8 and 8.8.1

Online domain join through System Configuration settings (Apply System Configuration task, or System Configuration applied as part of an imaging job)

Active Directory domain where the join account has delegated Create Computer objects permission on the target OU only

Cause

Deployment Solution 8.8 includes a rewritten Apply System Configuration task:

  1. In the Symantec Management Console, click Manage > Jobs and Tasks.
  2. Under System Jobs and Tasks > Deployment > right-click > New > Task and select the Apply System Configuration task under Deployment folder.

The rewrite adds ARM64 support and resolves domain join failures that occurred in other customer scenarios.

The rewritten task joins the computer to the domain first, which creates the account in the default CN=Computers container, and then moves the account to the configured OU. Earlier releases created the account directly in the configured OU.

If the domain join account has Create Computer objects permission only on the target OU, Active Directory refuses to create the account in CN=Computers. The join fails, and the move to the OU never runs.

 

How it works

Domain join in 8.7.x and earlier

The Deployment Solution (DS) agent passed the configured OU to the Windows domain join call. Windows created the computer account directly in that OU. The join account needed Create Computer objects permission on the target OU and nowhere else. Least-privilege delegation was enough.

Domain join in 8.8 and 8.8.1

The System Configuration task now joins in two steps:

  1. Join the domain. The DS agent calls the Windows join without an OU. NetSetup.log shows MachineAccountOU: (NULL). With no OU, Windows creates the computer account in the default computer container, CN=Computers.
  2. Move to the OU. After the join succeeds, the DS agent moves the computer account from CN=Computers to the OU configured in the task.

DSTasks.log (log created from production located at ..\Altiris Agent\Agents\Deployment\Logs) records these as two separate stages: a join stage and a move stage.

Where it fails and why

Active Directory checks create permission on the container where the object is created. In 8.8 that container is CN=Computers, not the target OU. A join account delegated only on the target OU cannot create an object in CN=Computers, so the domain controller refuses the request.

Windows then retries automatically with a join-only request (Options: 0x10000001). A join-only request expects the computer account to exist already. It does not, so the retry fails with 0x534. 

Because step 1 fails, the DS agent never runs step 2. The computer is not in the domain and not in the OU.

Pre-staged and re-imaged computers succeed because their account already exists. The join-only path reuses it and does not need create permission on CN=Computers.

Resolution

This issue has been reported to our Broadcom Development team and is targeted to be fixed under our ITMS 8.8.2 release.

A pointfix is available for ITMS 8.8.1 release. See CUMULATIVE POST ITMS 8.8.1 POINT FIXES

Review the following steps:

Step 1: Confirm the issue

  1. On the failing client, open C:\Windows\Debug\NetSetup.log. See KB DS 8.x Automation Logs for all DS client log locations.
  2. Find the first join attempt for the failed job. Confirm it shows MachineAccountOU: (NULL), and a Got DN line that contains CN=Computers.
  3. Confirm a second attempt follows with Options: 0x10000001 and NetpDoDomainJoin: status: 0x534.
  4. In Active Directory, confirm no computer account exists for the device name.
  5. Ask your Active Directory administrator whether the join account has Create Computer objects permission on CN=Computers. If it has permission only on the target OU, this article applies.

If NetSetup.log shows Account: \ with an empty account name and status 0x791, this article does not apply. See Additional information.

Step 2: Apply a workaround

Until the fix is available, use one of the following options.

Option A: Pre-stage the computer account in the target OU (recommended)

  1. In Active Directory, create a computer account in the target OU. Use the exact computer name the System Configuration settings assign to the device.
  2. Run the imaging job. The join reuses the existing account and does not need create permission on CN=Computers.

Option B: Grant Create Computer objects on CN=Computers to the join account

Granting the join account Create Computer objects permission on CN=Computers also lets the join succeed. This widens the join account's rights beyond the target OU, and many security teams reject it for that reason. Review it with your Active Directory and security teams before you use it.

NOTE:
Regarding Permissions:
In most cases, the domain credentials provided in the System Configuration must have "Join a computer to the domain" and "Create Computer Objects" permissions in the specific OU path provided.

 

Step 3: Verify the result

  1. Run the imaging job again on the affected device.
  2. Confirm the job completes without a domain join error in the Symantec Management Console.
  3. In Active Directory, confirm the computer account is in the target OU, not in CN=Computers.
  4. In NetSetup.log, confirm the last join attempt ends with NetpDoDomainJoin: status: 0x0. 
  5. In DSTasks.log, confirm both the join stage and the move-to-OU stage complete. 

Additional Information

OU syntax for the Configure Computer and Apply System Configuration tasks

TechDocs: Creating System Configuration Settings

Powered by Wolken Software