Add computer accounts to Active Directory groups during ConfigMgr OSD with verification, retries, compatibility modes, and CMTrace logging.
Current version: 1.0.0. This README follows main; downloads are versioned snapshots.
Documentation | Quick start | Deployment | Compatibility | Security | Troubleshooting
Standalone script: public gist snapshot. Keep its license and checksum files with the script; see distribution.
- An active ConfigMgr task sequence running as Local System in full Windows, after domain join and restart, with Windows PowerShell 5.1. WinPE and PowerShell 7 are not supported runtimes.
- Working domain DNS, time synchronization, and the member computer's secure channel.
- Trusted domain controller certificates for the default Kerberos over LDAPS on TCP 636 connection.
- A dedicated account delegated directory-read access and permission to update the target groups' membership. Do not use Domain Admin credentials.
- Download and verify the release ZIP and SHA-256 sidecar. Use its extracted
Scriptsfolder as the ConfigMgr package source, then distribute the package. It contains the self-containedAdd-ComputerToADGroup.ps1. - Place the script step after domain join and the required restart, once the requirements are met.
- Immediately before the script step, create the hidden custom ConfigMgr Task Sequence variables
ADGroupUserNameandADGroupPasswordfor a dedicated account with delegated group-membership permissions. - In Run PowerShell Script, set Script name to
Add-ComputerToADGroup.ps1and use this value in Parameters:
-GroupName 'Workstation-Certificate-AutoEnroll'
- Clear both credential variables immediately afterward on success and failure, and preserve a failed script result.
Read deployment for prerequisites, cleanup handling, parameters, and log locations. Complete the environment-validation checklist before a staged rollout.
| Output | Location or meaning |
|---|---|
| Group membership | Direct membership verified on the same domain controller connection used for the operation |
| Operational log | AddComputerToADGroup.log in _SMSTSLogPath, falling back to %WINDIR%\Temp |
Exit 0 / 1 |
Verified membership in every requested group / initialization or an operation failed |
Successful additions are not rolled back when another group fails. Verification does not prove replication to other domain controllers. Existing membership is left in place; retries are bounded. See architecture and logging for the full contract.
- Architecture
- Compatibility
- Deployment
- Development
- Distribution
- Examples
- Logging
- Release process
- Troubleshooting
- Validation
The v1.0.0 source passes Windows PowerShell 5.1 parser checks, PSScriptAnalyzer, mocked Pester tests, and exact-byte SHA-256 manifest verification. Tests cover parameter validation, LDAP requests, retry decisions, resource cleanup, logging, documentation, and validator process exits without writing to AD. Check CI for the status of a specific revision.
Live ConfigMgr and Active Directory testing was not executed for this release. Use the validation checklist to verify your environment before broad deployment.
Claudio Mendes · @vartaxe · vartaxe@outlook.com
See authors and artwork notices.
- Copy OSD Logs to File Share - companion task-sequence utility (documentation).
- Claudio Mendes / vartaxe - profile and project directory (GitHub).
MIT. See LICENSE.