Powershell join domain full automation

Posted on 2013-06-03
Medium Priority
Last Modified: 2014-10-25
I'm trying to create a script to completely automate joining the domain to use during a wds image deployment. I don't want to use the WAIK option because the password is stored in plain text in the xml file. So I've found some powershell scripts online that look like they could work.

This is the command I used to create my encrypted file which contains the password.


read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt


Here's the script I'm using.


$domain = "MYDOMAIN.COM"
$password = cat C:\securestring.txt | ConvertTo-SecureString -Force
$username = "$domain\MYUSERNAME"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential


Here's the error I'm getting.


Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.

PS C:\> $domain = "MYDOMAIN.COM"
PS C:\> $password = cat C:\securestring.txt | ConvertTo-Secure
String -Force
ConvertTo-SecureString : Cannot process argument because the value of argument
"input" is invalid. Change the value of the "input" argument and run the operat
ion again.
At line:1 char:66
+ $password = cat C:\securestring.txt | ConvertTo-SecureString <<<<  -Forc
    + CategoryInfo          : InvalidArgument: (:) [ConvertTo-SecureString], P
    + FullyQualifiedErrorId : ImportSecureString_InvalidArgument,Microsoft.Pow

Question by:revenuecyclepartners
LVL 23

Expert Comment

by:Stelian Stan
ID: 39216763
LVL 42

Accepted Solution

footech earned 2000 total points
ID: 39217469
You can use just WDS for this.  The image unattend file doesn't need to have credentials stored in it if you do an unsecure join (don't let the term fool you, there's nothing to worry about).  See here:
LVL 40

Expert Comment

ID: 39219575
ConvertTo-SecureString : Cannot process argument because the value of argument "input" is invalid. Change the value of the "input" argument and run the operation again.
Regarding your error..

Ideally your command should work without any error..
read-host -assecurestring | convertfrom-securestring | out-file C:\securestring.txt
$password = cat C:\securestring.txt | ConvertTo-SecureString -Force

The error possibly means your first command failed to create password and save it to the file..
Are you getting any output for command cat C:\securestring.txt?
We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!


Author Comment

ID: 39227100
Yes cat C:\securestring.txt outputs what looks like encrypted text.

I've also tried creating the password file with he following commands and have had similar errors.

$password = "PASSWORD"
$secure = ConvertTo-SecureString $password -force -asPlainText
$bytes = ConvertFrom-SecureString $secure
$bytes | Out-File secureString.txt
LVL 40

Expert Comment

ID: 39227173
I hope you are using the same account to create and read the password..

Author Comment

ID: 39244750
I tried creating and using the encrypted password file from the same user as well as from different user accounts with no luck.

It doesn't make sense to me that you can only create and use a password file while logged in as that user, what's the point of having the cred file if you can't use it to auto logon for instance when joining the domain. Before I join the domain I'm logged on to the comptuer with a local user account and the domain is going to ask me for domain creds when I send the join domain request.

Featured Post

WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question