Azure AD DS join error : unable to add VMs the managed domain about avdblueprint HOT 3 OPEN

Hello Jean-Loup,

Which machine or machines did not get domain joined? The session hosts should be getting joined by the managed identity, as they are created. If they don't, the deployment will fail at that point. If it's the management VM, that domain join is performed by the account '[email protected]'. And of course, if that account is not added to the right group, that operation will fail, as well as most other operations after that.

I have gotten to this point and have some success with deleting any objects in your resource group with the text 'mgmtvm' in them. There should be a VM, a NIC, a PIP, and a disk. After those get deleted you could try re-running the deployment without changing any parameters. The thing I worry about as of yet is the key vault name you and I were testing before.

I am testing a method suggested by a peer, which is to name the key vault the same way we name the storage account used for the FSLogix profiles. It uses a concatenation of resource prefix + a uniquestring based on your subscription ID. The reason is that this unique string is a hash of whatever you feed into it. Since your subscription is the same each time, and if the resource prefix is the same, then you will get a value for key vault name that is unique to your deployment and subscription, but should be the same if you re-deploy using the same resource group name.

In my case for a deployment I am doing right now, I have an 8 character resource prefix and have a 12 character unique string concatenated to that. I believe this will help resolve the issue of possible duplicate key vault names, while at the same time setting the key vault name to be the same for a redeploy with the same prefix name.

I hope that helps.

Thanks,

Robert Smith

from avdblueprint.

Hi Robert,

All the session hosts were no joined to the managed domain.
Did the script add the managed identity to the AAD DC Administrators group ?

Thanks,

Jean-Loup

from avdblueprint.

Hello Jean-Loup,

I have seen problems before with timing of adding members to AAD DC Administrators group. We put a lot of work in to address the timing. But if you check that group and you don't see any members, you can pretty much write that one off as a failed deployment. If you cleanup and try again and is succeeds, it was an ephemeral issue. If you keep having that same issue, check to make sure the account created by the Blueprint for administering tasks (domainadmin) gets created. If it doesn't get created, you might check the log files to see if there is some issue with that account getting created.

Thanks,

Robert M. Smith

from avdblueprint.