SOLVED SCCM OS Task Sequence fails domain join in specific location

[TimH]

Hi!

We are currently running the 2409 version of SCCM and are using windows 11 24H2 image for deployment.
We deploy in 3 different countries, but the domain join step is the same for every country, just the OU that is different.
So we have 1 step in the TS "Apply Network Settings":

Where it joins the domain based on $OSDOUNAME that is selected in the Frontend OSD.

But when i run the task sequence locally at our office it works fine.
When our IT technician in 1 of the countries tries, it fails to join domain.
I tried looking at the NETSETUP.log and it only showed this:

Nothing about the given hostname of the laptop of the domain it should join.
It completed with 0x0 but never joins the domain.
The step right after "apply network settings" is a cmd with "shutdown /r /f /t 30"

The TS is working in 2 out of 3 countries.
It fails on Enable BitLocker with the error that the machine is not domain joined.
I've checked the permissions to the OU of the country it fails on, and the permissions is the same as the 2 other countries, regarding the service account used for AD join.

Following steps have been tried:
1) Different laptops just to rule out the laptop issue.
2) Clear TPM and check it is valid.
3) Different port in the switch.
4) Different setup (dock with ethernet, usb to ethernet adapter, monitor with dock.)
5) checked the traffic to make sure nothing is blocked in the firewall. (we had some UDP 500 traffic the was blocked, but it was not the problem, since we tried to allow it for test purpose.)
6) Restart of the DP and MP.
7) Re-creation of TS


I don't know what to try next.

Anyone had the same issue before and found a solution?

Best Regards!

 

[Stanley Road]

Why dont you make a copy of the TS and deploy it in debugging mode. then set 'Stop' at Apply Network setting and One at Driver Installations. With the log file open as you run it you may see what is happening in real time. Also try adding it to that OU from cmd line using the account you use in your domjoin step?

 

[TimH]

Why dont you make a copy of the TS and deploy it in debugging mode. then set 'Stop' at Apply Network setting and One at Driver Installations. With the log file open as you run it you may see what is happening in real time. Also try adding it to that OU from cmd line using the account you use in your domjoin step?

Hi Stanley!

Thank you for the tip!
I've tried to run it in debug mode and the NetSetup.log that same as before.
It exits with 0x0 on the DoDomainjoin step in the log.

The main thing is that the ADJoinAccount is the same we use in other locations where it works perfectly.
I double checked the LDAP OU is correct and i can do it manually from CMD.

I tried remove the roles from the DP and recreate it, it seems to have fixed the issue as of right now, but don't know if it will happen again.
It seemed like the DP was in a bad state after 2409 update.