Earlier quoted context omitted.
> preseed files to automate the install, domain join, Genuine question, wouldn't that require a kerberos ticket to work? Or at least some high privilege password that you might not want to keep around your preseed files? Bootstrapping trust is a tricky problem. Most that I've seen tend to go with some custom solution.
Yes, but you can really tighten that privilege in practice. Yes having the ability to create computers in AD is potentially dangerous but in our deployments all the "AD Join Account" can do is create, delete, and reset computer passwords in one specific OU that new computers are moved out of once provisioned. We don't broadcast the join password and rotate it every so often but we also don't really care if it gets ou…
Having an OU that computers are provisioned in, and then moved out of later on would have help me a lot.