Domain Join Cleanup Script

🔒 Secure Bits 💡
𝗝𝗼𝗶𝗻𝗶𝗻𝗴 𝗱𝗲𝘃𝗶𝗰𝗲𝘀 𝘁𝗼 𝘆𝗼𝘂𝗿 𝗔𝗗 𝗱𝗼𝗺𝗮𝗶𝗻? 𝗧𝗵𝗲𝗿𝗲’𝘀 𝗺𝗼𝗿𝗲 𝘁𝗼 𝗶𝘁.
(Updated version — thanks to the great feedback from Adonis Moreira & Andreas Vikerup 👏)

A few weeks ago I posted a Secure Bits on creating a 𝗵𝗮𝗿𝗱𝗲𝗻𝗲𝗱 𝘀𝗲𝗿𝘃𝗶𝗰𝗲 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 for domain joins. Since then, I’ve 𝘂𝗽𝗱𝗮𝘁𝗲𝗱 𝗯𝗼𝘁𝗵 my guide and tools — and made a short video walkthrough. Here’s what’s new and what to watch out for:

𝗛𝗮𝗿𝗱𝗲𝗻𝗶𝗻𝗴 𝗼𝗳 𝘆𝗼𝘂𝗿 𝗱𝗼𝗺𝗮𝗶𝗻 𝗷𝗼𝗶𝗻 𝗽𝗿𝗼𝗰𝗲𝘀𝘀:
✅ Create a dedicated service account (complex password, no extra rights).
✅ Delegate the required permissions on the Computers OU.
✅ Set “Add workstations to domain” GPO privilege → your service account + Domain Admins.
✅ Set ms-DS-MachineAccountQuota to 0 → block default behavior allowing any authenticated user to join 10 devices.

Devices can be joined either via the “Add workstations to domain” user right (limited by ms-DS-MachineAccountQuota — default 10 per Authenticated User) or via delegated Create Computer Objects on the target OU (no quota/user-right needed). Set the attribute to 0 to block the default Authenticated Users path, and keep the GPO scoped only to your joiners/DA group so intent stays explicit.

📌 𝗗𝗼𝗻’𝘁 𝗳𝗼𝗿𝗴𝗲𝘁: after joining, always move devices out of the default Computers container to avoid inherited permissions (you also want to apply some GPOs, right?)

💥 𝗕𝘂𝘁 𝗵𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝗜 𝗺𝗶𝘀𝘀𝗲𝗱 𝗹𝗮𝘀𝘁 𝘁𝗶𝗺𝗲 —
When you join a device using a service account, that account becomes 𝗼𝘄𝗻𝗲𝗿 of the new computer object and may have dangerous Access Control Entries (𝗔𝗖𝗘𝘀).

𝗧𝗵𝗶𝘀 𝗰𝗿𝗲𝗮𝘁𝗲𝘀 𝗮 𝗵𝗶𝗱𝗱𝗲𝗻 𝗿𝗶𝘀𝗸:
🔓 If the join account is compromised, it can abuse permissions on existing joined computers.

𝗡𝗲𝘄 𝗥𝗲𝘀𝗼𝘂𝗿𝗰𝗲𝘀 𝘁𝗼 𝗙𝗶𝘅 𝗧𝗵𝗶𝘀:
🔹 𝗔𝗗𝗣𝗿𝗼𝗯𝗲 𝘂𝗽𝗱𝗮𝘁𝗲:
→ Now detects foreign object ownership after domain join.

🔹 𝗗𝗼𝗺𝗮𝗶𝗻 𝗝𝗼𝗶𝗻 𝗚𝘂𝗶𝗱𝗲 𝘂𝗽𝗱𝗮𝘁𝗲:
→ Now includes a PowerShell cleanup script to:
• Change object ownership to Domain Admins
• Remove join account ACEs from computer objects

📹 Links for products and write-up from Andreas are in comments.

⸻

💬 How do you manage secure domain joins?
Do you clean up ACEs and ownership after provisioning?