Recommended Posts

Hi guys

is there a way of adding a windows xp machine to a domain from the AD server running Windows Server 2008 R2 using netdom join workstation /domain:mydomain.local from the command line of the server?

At the moment its failing with a Access is denied.

One thing to bare in mind is that the local machine's admin password has been forgotten. Otherwise I wouldn't be bothering with this. I know there a ways of getting that reset but the PC is thousands of miles away and trying to avoid guiding the end user on how to use ntpasswd.

thanks in advance

Link to comment
https://www.neowin.net/forum/topic/1055884-join-domain-using-netdom/
Share on other sites

So the PC is just sitting there all by it's lonesome? How about having them download and run one of those bootable linux discs that can reset passwords for local accounts?

Edit: it seems that's what ntpasswd is...sorry I'd never heard of that before...

So the PC is just sitting there all by it's lonesome? How about having them download and run one of those bootable linux discs that can reset passwords for local accounts?

Edit: it seems that's what ntpasswd is...sorry I'd never heard of that before...

Yep, as a background story, pc got removed from the domain by one of guys who normaly did a bit of support now and then and as luck would have it the documented local password is not working. So what we're saying is without having a workable user account there's nothing that can be done remotely?

If that's the case then I best prepare myself to start guiding the user to try and run through the reset password utility I guess. :/

Hmmmm - its been a while since I have done this.. But yeah I do believe you have to have local admin account get it to join a domain. You can always create the computer account on the domain and setup any account to be able to join the domain from the domain side.. Normally any domain authenticated user can join 10 machines to a domain - unless you have correctly adjusted these permissions.

But to actually join the machine I do believe the account your logged in on the machine has to have local admin rights.. Other wise that would be pretty messed up you could login as guest or something on a machine - join it to a domain you have setup, and since domain admins are give local admin rights on the box that joins the domain you would now have an account on the box with full admin rights. That would be a bit of security issue!

Walk the user through reset of the local account - the tools are pretty simple any monkey could be walked through the process. Then once the box is joined just remotely change the local admin account. Problem is the fact that your showing the user the way to hack any machine - he could use this new learned skills for evil in the future ;) heheheh

Its not like any 8 year old can not look up this stuff on google in 12 seconds -- its just that users are normally dumber than 8 year olds when it comes to anything to do with a computer! So you hand hold them through learning such a dangerous thing - next thing you know you have all user doing it! Users are like monkeys learning how to use a stick to grab ants out of the ant hill -- they pass that **** on to the next monkey! ;)

If the machine has access to the network and you have admin rights, why not just log onto the machine and join it for him....there are quite a few utilities that allow you to stay logged in at the logon prompt provided you have the admin creds of the machine.

"provided you have the admin creds of the machine."

Thats the thing sc302 the way I read it there is NO local admin account he can use.

Now if the machine had been removed from the domain, and had at some point been logged in with domain admin account -- it would still be cached and as long as the machine is not connected to the network with domain access you could log in with domain admin rights account from cache and change the local password.

As to recovery options. If you have SA from microsoft -- you should have access to DART, which you could create a recovery tools disk with.. And you can have him reboot with that CD/DVD and you can remote it and recover/change the local password.

You would think most companies that are licensed would take advantage of the tools MS provides?

http://www.microsoft.../mdop/dart.aspx

Walk the user through reset of the local account - the tools are pretty simple any monkey could be walked through the process. Then once the box is joined just remotely change the local admin account. Problem is the fact that your showing the user the way to hack any machine - he could use this new learned skills for evil in the future ;) heheheh

Its not like any 8 year old can not look up this stuff on google in 12 seconds -- its just that users are normally dumber than 8 year olds when it comes to anything to do with a computer! So you hand hold them through learning such a dangerous thing - next thing you know you have all user doing it! Users are like monkeys learning how to use a stick to grab ants out of the ant hill -- they pass that **** on to the next monkey! ;)

My exact fears..

If the machine has access to the network and you have admin rights, why not just log onto the machine and join it for him....there are quite a few utilities that allow you to stay logged in at the logon prompt provided you have the admin creds of the machine.

Machine is connected to the network but no admin rights access as the passwords documented does not work for this 1 machine, so login into the actual machine is out. Will just proceed with pass reset on Monday and just move forward with that.

Thanks for all the responses and happy birthday Budman.. :D

Now this might be frown upon - but if you want to try the dart option where you can remote his machine and change the password using a MS tool -- just let me know (pm) and I might be able to send you the tools needed to create the disk :shiftyninja:

But to be honest if your a MS house you should have access to these tools already - I can walk you through how to do it with the remote control option. Its been awhile since I have need to do it. So I would have to verify - but I do believe when you do it he wouldn't actually see you resetting the password. And either way it would be official MS tools - so he might not comprehend that any 8 year old can grab the tools and do this on any box, etc.

^ agreed if they have local admin on the box they are trying to join!

The problem here is the account they are logged into the box with does not have local admin rights - so even if he has an account that has permissions to join the domain. He does not have the permissions to do that on the box he is trying to join.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • My father still uses a programme written in dbase3. Still manages to work with a little help from dosbox. 
    • Microsoft hides these secret Windows 11 performance boost settings available on every PC by Sayan Sen Windows enthusiasts often look for ways to extract as much performance out of their systems as possible, and it's often the case that they try and do so while trying to minimize the heat and power consumption. This is especially relevant in the case of mobile Windows PCs since laptops and notebooks tend to get hot and management of that heat and power is harder in such a form factor. As such users often turn to techniques like under-volting which can be used to squeeze out the maximum capabilities of a chip while also maintaining lowered power levels. There are official apps from AMD and Intel with the likes of Ryzen Master and XTU (Extreme Tuning Utility). While these are quite handy, most enthusiasts probably prefer to dig into the BIOS and play around with settings there like Curve Optimizer on Ryzen, which lets users set various frequency-voltage scaling values. These are essentially called P-States. If you are not familiar with them, Processor Power Management is done through Advanced Configuration and Power Interface (ACPI) P-states and C-states. While P-states or performance pwoer states handle CPU voltage-frequency scaling, C-states deal with CPU sleep states so that some of the CPU functions, which are not necessary at that moment, can be disabled. The P-states and C-states work together to make the processor run more efficiently. It helps the OS and apps determine which cores can be parked and which should be boosted. Of course not every user is an enthusiast or knows the technicalities and integrities of how things like overclocking or undervolting work. Thankfully for them Windows itself offers something pretty cool, though it is hidden by default on all systems. By default, Windows only has two P-States, "Minimum Processor State" and "Maximum Processor State." However, this can be changed with a Registry trick to expand the options under a secret "Processor performance boost mode" dropdown. This essentially enables the HWP or hardware P-States available on a device, and these are not controlled just by the OS itself as the underlying hardware gets involved too. In total there are five Processor Performance Boost Mode profiles that control how Windows requests and allows CPU turbo/boost behavior under the different power policies. They are: Disabled: In this mode, processor boosting is effectively turned off. The CPU will avoid entering turbo or boost frequencies and instead operate closer to its base frequency ceiling. This can significantly reduce power consumption and heat output, but at the cost of reduced burst performance and responsiveness in short workloads. Enabled: This is the standard behavior where boost functionality is allowed under normal conditions. The processor can opportunistically increase frequency when workload demands it, balancing performance gains with power and thermal constraints as managed by the system. Aggressive: Aggressive mode favors performance more heavily, allowing the CPU to enter higher boost states more readily and sustain them longer. This should in theory improve responsiveness under bursty or heavy workloads but increases power draw and thermal output compared to the default enabled behavior. Efficient Enabled: This mode still allows boosting, but with a stronger bias toward energy efficiency. The system attempts to use boost more selectively, avoiding unnecessary frequency spikes when the performance gain is marginal. Efficient Aggressive: This is a hybrid approach where boost is still performance-responsive, but the system continuously weighs efficiency more heavily than in Aggressive mode. It aims to deliver noticeable performance improvements while reducing wasted power in less demanding scenarios. Here's how to enable the Processor performance boost mode: Open Registry Editor: Press Win+R, type regedit, and click OK. Go to: HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\be337238-0d82-4146-a960-4f3749d470c7 (where HKLM stands for HKEY_LOCAL_MACHINE_) Modify the value of Attributes from 1 to 2 (you can find modify option by right-clicking) After that, exit Registry, you should now be able to see the new "Processor performance boost mode" dropdown menu: As you can see there are now five new P-States or CPPC states or power profile available that help define the boost mode processor setting on your PC. Wrapping it up here's a quick run-down of the settings as defined by Microsoft itself. Setting Description Disabled The corresponding P-state-based behaviour is disabled. Collaborative Processor Performance Control (CPPC) behaviour is disabled. Enabled The corresponding P-state-based behaviour is enabled. CPPC behaviour is Efficient Enabled. Aggressive The corresponding P-state-based behaviour is enabled. CPPC behaviour is Aggressive. Efficient Enabled The corresponding P-state-based behaviour is Efficient. CPPC behaviour is Efficient Enabled. Efficient Aggressive The corresponding P-state-based behaviour is Efficient. CPPC behaviour is Aggressive. Aggressive At Guaranteed Windows calculates the desired extra performance above the guaranteed performance level, and asks the processor to deliver that specific performance level. Efficient Aggressive At Guaranteed Windows always asks the processor to deliver the highest possible performance above the guaranteed performance level. In the next part we shall be comparing these settings to explore how much of a benefit or regression they can provide in terms of performance and power efficiency. If you decide to change the values on your system and are experiencing problems like crashes or an overheating PC, make sure to revert the steps back to the original state.
    • I think he means you haven't reviewed previous UFC games. Of course it doesn't matter... Every time you just report on something that involves the President even if just simply what happened you guys usually get accused of being anti-Trump. We live in fun times.
  • Recent Achievements

    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
    • One Month Later
      agatameier earned a badge
      One Month Later
    • Week One Done
      agatameier earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      518
    2. 2
      +Edouard
      198
    3. 3
      PsYcHoKiLLa
      147
    4. 4
      ATLien_0
      93
    5. 5
      Steven P.
      77
  • Tell a friend

    Love Neowin? Tell a friend!