Windows 10: How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

Miloslav Mrvík · Feb 1, 2025 at 10:22 AM

EDIT sorry - I've somehow got to en-us varaint :Hi,I've asked this question earlier: https://answers.microsoft.com/cs-cz/windows/forum/all/nelze-se-p%c5%99ihl%c3%a1sit-ke-sv%c3%a9mu/76d7a786-45f3-4dee-9bad-c2b6466dfa68In short - my home PC joined a school domain which exposed it to the school administrators. You and official MS support recommended clean reinstall of Windows in order to resolve the shituation. I.e. this change can not be reverted by normal configuration.As a followup to that I've another question: Is it possible to prevent windows from joining a domain?We're talking about kids

:)

Brink · Feb 1, 2025 at 10:34 AM

Netjoin: Domain join hardening changes for Windows

Summary Windows updates released on and after October 11, 2022, contain additional protections introduced by CVE-2022-38042. These protections intentionally prevent domain join operations from reusing an existing computer account in the target domain unless:

The user attempting the operation is the creator of the existing account. OR

The computer was created by a member of domain administrators.

Legacy behavior Before you install the October 11, 2022, or later cumulative updates, the client computer queries Active Directory for an existing account with the same name. This query occurs during domain join and computer account provisioning. If such an account exists, the client will automatically attempt to reuse it. Note The reuse attempt will fail if the user who attempts the domain join operation does not have the appropriate write permissions. However, if the user has enough permissions the domain join will succeed. There are two scenarios for domain join with respective default behaviors and flags as follows:

Domain Join (NetJoinDomain)

Defaults to account reuse (unless NETSETUP_NO_ACCT_REUSE flag is specified)

Account provisioning (NetProvisionComputerAccountNetCreateProvisioningPackage).

Defaults to NO reuse (unless NETSETUP_PROVISION_REUSE_ACCOUNT is specified.)

New behavior Once you install the October 11, 2022, or later Windows cumulative updates on a client computer, during domain join, the client will perform additional security checks before attempting to reuse an existing computer account. Algorithm:

Account reuse attempt will be permitted if the user attempting the operation is the creator of the existing account.

Account reuse attempt will be permitted if the account was created by a member of domain administrators.

These additional security checks are done before attempting to join the computer. If the checks are successful, the rest of the join operation is subject to Active Directory permissions as before. This change does not affect new accounts. Note After installing the October 11, 2022, or later Windows cumulative updates, domain join with computer account reuse might intentionally fail with the following error: Error 0xaac (2732): NERR_AccountReuseBlockedByPolicy: “An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.” If so, the account is intentionally being protected by the new behavior. Event ID 4101 will be triggered once the error above occurs and the issue will be logged in c:\windows\debug\netsetup.log. Please follow the steps below in Take Action to understand the failure and resolve the issue. Take Action Review computer account provisioning workflows and understand if changes are required.

Perform the join operation using the same account that created the computer account in the target domain.

If the existing account is stale (unused), delete it before attempting to join the domain again.

Rename the computer and join using a different account that doesn’t already exist.

If the existing account is owned by a trusted security principal and an administrator wants to reuse the account, they might do so by temporarily setting the following registry key at the individual client computer level. Then immediately remove the registry setting after the join operation is complete. No restart is necessary for changes to the registry key to take effect.

[table][tr][td]Path[/td] [td]HKLM\System\CurrentControlSet\Control\LSA[/td] [/tr] [tr][td]Type[/td] [td]REG_DWORD[/td] [/tr] [tr][td]Name[/td] [td]NetJoinLegacyAccountReuse[/td] [/tr] [tr][td]Value[/td] [td]1 Other values are ignored.[/td] [/tr] [/table]
Important guidance for using option 4 Caution: If you choose to set this key to work around these protections, you will leave your environment vulnerable to CVE-2022-38042 unless your scenario is referenced below as appropriate. Do not use this method without confirmation that the Creator/Owner of the existing computer object is a secure and trusted security principal. It is appropriate to use solution 4 in the following scenarios:

An IT admin with delegated permissions needs to rejoin a computer to the target domain for troubleshooting purposes and the original account creator is a trusted account. OR

A deployment scenario in which computer accounts are created before using a dedicated service account (such as SCCM or other software) and the domain join is performed by a second dedicated account with delegated domain-join permissions (for example, "This account is allowed to join this computer to the domain").

Microsoft might remove support for the NetJoinLegacyAccountReuse registry setting in a future update and replace it with an alternative method. This article will be updated if and when such changes take place. Nonsolutions

Do not add service accounts or provisioning accounts to the Domain Admins security group.

Do not manually edit the security descriptor on computer accounts in an attempt to redefine the ownership of such accounts. While editing the owner will enable the new checks to succeed, the computer account might retain the same potentially risky, unwanted permissions for the original owner unless explicitly reviewed and removed.

Do not add the NetJoinLegacyAccountReuse registry key to base OS images because the key should only be temporarily added and then removed directly after the domain join completes.

New event logs [table][tr][td]Event log[/td] [td]SYSTEM[/td] [/tr] [tr][td]Event Source[/td] [td]Netjoin[/td] [/tr] [tr][td]Event ID[/td] [td]4100[/td] [/tr] [tr][td]Event Type[/td] [td]Informational[/td] [/tr] [tr][td]Event Text[/td] [td]"During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.%nAn attempt to re-use this account was permitted. %n%nDomain controller searched: %1%nExisting computer account DN: %2%n%nSee KB5020276—Netjoin: Domain join hardening changes - Microsoft Support for more information.[/td] [/tr] [/table]
[table][tr][td]Event log[/td] [td]SYSTEM[/td] [/tr] [tr][td]Event Source[/td] [td]Netjoin[/td] [/tr] [tr][td]Event ID[/td] [td]4101[/td] [/tr] [tr][td]Event Type[/td] [td]Error[/td] [/tr] [tr][td]Event Text[/td] [td]"During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.%nAn attempt to re-use this account was prevented for security reasons.%n%nDomain controller searched: %1%nExisting computer account DN: %2%nThe error code was %3.%n%nSee KB5020276—Netjoin: Domain join hardening changes - Microsoft Support for more information."[/td] [/tr] [/table]
Debug logging is available by default (no need to enable any verbose logging) in C:\Windows\Debug\netsetup.log on all client computers. Example of the debug logging generated when the reuse of the account is prevented for security reasons: NetpGetComputerObjectDn: Crack results: (Account already exists) DN = CN=Computer2,CN=Computers,DC=contoso,DC=com NetpGetADObjectOwnerAttributes: Looking up attributes for machine account: CN=Computer2,CN=Computers,DC=contoso,DC=com NetpCheckIfAccountShouldBeReused: Account was created through joinpriv and does not belong to this user. Blocking re-use of account. NetpCheckIfAccountShouldBeReused:fReuseAllowed: FALSE, NetStatus:0x0 NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac NetpProvisionComputerAccount: LDAP creation failed: 0xaac ldap_unbind status: 0x0 NetpJoinCreatePackagePart: status:0xaac. NetpJoinDomainOnDs: Function exits with status of: 0xaac NetpJoinDomainOnDs: status of disconnecting from '\\DC1.contoso.com': 0x0 NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on 'contoso.com' returned 0x0 NetpJoinDomainOnDs: NetpResetIDNEncoding on 'contoso.com': 0x0 NetpDoDomainJoin: status: 0xaac
Click to expand...

Source: https://support.microsoft.com/en-us/...f-1caaf421baf8

Brink · Feb 1, 2025 at 10:34 AM

Join Windows 10 PC to a Domain

@rseiler,

I just finished clean installing Windows 10 Enterprise build 17093 in a VM using a local account, and it still has the same steps in the tutorial for me.

Is your PC already joined to a domain?

bdanmo · Feb 1, 2025 at 10:34 AM

UnattendedJoin error: failed to find the domain data (0x6e)

Thanks for the suggestion! I don't want to add a domain account, as this is a generic unattended install that will be used for all company machines. Do you think it's possible that the computer would join the domain if, instead of using UnattendedJoin in specialize, I used your steps but left out the specific account? The other thing I was thinking was to use a generic account to allow the domain join during the specialize step. I added a machine password in the UnattendedJoin component, and instead of getting the error listed above, I got an authentication error, which makes me think I could probably do a secure join instead of the unsecure join. Thoughts?

Windows 10: How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén? - Similar Threads - prevent joining domain

How to prevent Windows from joining a domain?

How to prevent Windows from joining a domain?

How to prevent Windows from joining a domain?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

How to prevent Windows from joining a domain? / Jak ve Windows zakázat vstup do domén?

Jak ve Windows zakázat vstup do domén?

Jak ve Windows zakázat vstup do domén?

Jak ve Windows zakázat vstup do domén?

How to join or remove a Domain from Windows 10