Skip to main content

118: Stop AD DJ for new workstations

Implementation Effort: Medium
User Impact: High

Overview​

Stopping traditional on-premises Active Directory domain join for new workstations is a strategic design decision, not just a provisioning tweak. In Zero Trust terms, moving new devices away from default AD domain join reduces inherited trust assumptions, simplifies remote provisioning, and helps standardize on cloud identity, Intune management, and Conditional Access. The change should be governed through architecture standards, build process updates, and exception handling rather than left to individual deployment teams.

Implementation Guidance​

  1. Declare the target standard clearly: new corporate Windows devices should be Microsoft Entra joined unless an approved exception exists. Publish what qualifies as an exception and who approves it.
  2. Update all provisioning paths so they no longer default to AD domain join. This can include Autopilot profiles, imaging task sequences, OEM instructions, procurement catalog notes, and desktop engineering runbooks.
  3. Identify dependencies that still assume domain-joined workstations, such as legacy file shares, GPO-driven app settings, certificate enrollment, print mappings, or on-premises authentication flows. Assign owners and remediation dates for each dependency.
  4. Create an exception path for devices that must remain hybrid joined or domain joined for a limited time. Exceptions should be tracked, reviewed, and retired rather than becoming a second default standard.
  5. Train the help desk and desktop engineering teams on the new support model, including local admin controls, password reset paths, self-service provisioning, and how to troubleshoot cloud-managed devices.
  6. Measure adoption with reporting from procurement, Autopilot registration, and Intune enrollment so you can prove the standard has actually changed.

Video Walkthrough​

Reference​