Windows 10: Remote Employees Using Domain-Joined Computers Getting "Activate Windows" Warnings

In our enterprise environment we deploy Surface devices that are joined to the domain and Windows is activated with the KMS server. These devices are provided to some staff that do not come into the office for long periods of time, so then the "Active Windows" message appears after a while.Since we are not able to allow these employees to use VPN, how can we avoid the dreaded "Activate Windows" message from appearing on these devices?

:)

 

UnattendedJoin error: failed to find the domain data (0x6e)

Thanks for the suggestion! I don't want to add a domain account, as this is a generic unattended install that will be used for all company machines. Do you think it's possible that the computer would join the domain if, instead of using UnattendedJoin in specialize, I used your steps but left out the specific account? The other thing I was thinking was to use a generic account to allow the domain join during the specialize step. I added a machine password in the UnattendedJoin component, and instead of getting the error listed above, I got an authentication error, which makes me think I could probably do a secure join instead of the unsecure join. Thoughts?

 

Joining a Windows 10 Pro machine to Azure AD without linking/registering an employees email address to that computer

I have been researching for a few weeks now trying to figure out how to join Azure AD for new purchased machines when setting up the machine.

I have two different scenarios that would be joining azure AD.

1. Shipping a machine that has not been setup yet directly to an employee's location. I have to walk through step by step on how to configure settings, join the azure domain, and how to download a program or two. Is their a Microsoft process that I can put
information into that knows that computer needs to join our azure domain? I do not wish to sign in with my credentials to join the azure domain each time we order a new computer.

2. If my company has a windows 10 Home edition machine that we would want to add to our Azure AD, We purchase a windows 10 pro license and activate it under the settings. our next step is going into the settings to join an azure AD domain through a Microsoft
account, however I do not wish to register my account on every computer in our environment. Is their a way to have this computer join azure AD with some sort of a token or activation process? The second issue to this scenario is after joining the azure AD
with my credentials the local admin account is still active and I need to then go through the process of logging in and removing this account.

What would be the best process of joining my environments machines to our Azure AD network without having to register my account with each computer?

 

Time synchronization for remote domain-joined computers

We're oddly not finding good guidance for this situation elsewhere, nor even anyone asking questions about it, so I thought I'd ask here.

We have company workstations joined to the local domain for the usual centralized control and policy administration purposes. Domain-joined computers sync time with a domain controller. Easy enough concept.

However, it's common for computers to be off-network nowadays. Often, for extended periods of time - weeks, perhaps months. We've specifically designed workflows such that people can work without establishing a connection to the office network.

Without the ability to communicate with a domain controller, domain-joined computers will not fall back to other sources and
will not synchronize time at all. We've been unable to identify any settings for something like, "prefer to sync with the domain, but then fall back to a trusted public NTP source."

For most people, it does not seem to be a problem, but there are one or two devices that seem to have slow clocks that noticeably drift over the scale of days or weeks. Regardless of these problem kids, has anyone found a reasonable means of ensuring time
sync occurs for remote computers?