Today I found myself in an odd situation. A remote work PC needed join to Active Directory. But VPN would not work unless PC was already in the domain. Catch 22. After some searching and reading, I found that using “DJOIN” in Windows 7+, the PC could offline-authenticate. DJOIN is bundled with the system, by default. Here’s what to do:
On a trusted PC:
- On a CMD prompt as the appropriate Domain Admin or delegate.
- Run:
djoin /provision /domain ad.example.com /machine PC-NAME /reuse /savefile blob.txt
- Copy blob.txt to the PC.
On remote PC:
- Open a privileged
CMD
(right-click on CMD, select run as Administrator). - Run:
djoin /requestODJ /loadfile blob.txt /windowspath %SystemRoot% /localos
- Reboot
- I still had to login as the local account and establish the VPN connection, which this time worked just fine.
- When VPN is running, Switch user (Win+L).
- Login as ad\username
Presto! From here on, I disconnected the VPN from my local account and started it again with the AD account.