In the first of this new multi-part series, I will show you how to take you Windows Deployment to the next level.
(For this series, we're assuming your running Server 2012 R2 with the latest updates, and the latest release of MDT 2013).
This article looks at locking down the os.deploy account that you use to automatically join computers to the domain.
So, let us improve the security of the mdt join account. This account which we have specified in CustomSettings.ini (Windows Deployment, Part 1: Configuring the Deployment Environment) and which is used by MDT to join the target computer to the domain.
If we leave this account as a Domain User, then MDT will be able to join the first few computers it installs into the domain but then will fail to join any others.
This is because by default Domain Users can only join 10 computers to the domain.
In our initial article, we made the account a member of the domain admins group – of course, perfectly acceptable in a lab environment, but not so in the real world.
This is because of these three facts:
- The domain admin password is visible in the customsettings.ini
- The domain admin password is sent in plain text across the network
- The domain admin password is temporarily stored on the remote pc
So, how do we overcome this??