> For the complete documentation index, see [llms.txt](https://docs.foundryosd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.foundryosd.com/foundry-osd/domain-join/zero-touch.md).
# Zero-touch Domain Join
**Zero-touch Domain Join** stores the join account on the deployment media, encrypted with the Deployment password, so a deployment joins the domain without anyone typing an account.
A shared join account, three domains that are Ready, and the OUs of the selected domain.
## Before you start
* Turn on [Password protection](/foundry-osd/general.md#password-protection) on **General** and set the **Deployment password**. This mode cannot be used without it.
* Get a join account from your Active Directory administrator, written as `DOMAIN\user` or `user@domain`, and its password.
* The device must reach a domain controller when the join runs, after the restart. The Windows edition must not be a Home edition, and each device needs its own computer name.
## Configure
1. Open **Domain Join > Zero-Touch** and select **Enable**. If another Domain Join or Windows Autopilot mode is active, confirm with **Change mode**.
2. Under **Shared join account**, enter the **Account (DOMAIN\user or user\@domain)** first, then its **Password**. A password typed before a valid account is not kept.
3. Under **Domains**, select **Add**, enter the **Domain name**, such as `corp.contoso.com`, and select **Add domain**. The domain uses the shared account unless you select **Use a dedicated account** and enter another account and its password. Repeat for each domain.
4. Optional: select a domain, then under **Organizational units** select **Add**, enter a **Display name** and the **Distinguished name** of the OU, such as `OU=Workstations,DC=corp,DC=contoso,DC=com`, and select **Add OU**. **Import from domain** reads the OUs from the directory instead.
5. Check that every domain shows **Ready** in **Status**, and that no message remains under **Shared join account** or under **Domains**.
6. Open **Start** and create or update the media.
**Ready** only covers the account and password of that domain. Missing Password protection is reported under **Shared join account**, and an empty list under **Domains** ("Add at least one domain."): either one blocks media creation even when every domain is **Ready**.
A password belongs to its account: if you change an account, enter its password again. When you select **Edit** under **Domains** for a domain that has a dedicated account, an empty password keeps the current one.
## What the technician sees
The technician unlocks the media with the Deployment password and is never asked for the join account. The [Domain Join step](/foundry-deploy/domain-join.md) of Foundry Deploy shows the domain, with the default preselected, and asks for the OU only when the domain lists several. The technician can choose **Do not join a domain** instead.
When the step is shown, Foundry Deploy checks the account stored on the media for the selected domain with a domain controller. If the domain refuses it, the technician cannot continue with that domain: correct the account or its password here and create the media again. If the domain cannot be reached from the deployment network, Foundry Deploy shows a warning and the deployment continues. See [Account check](/foundry-deploy/domain-join.md#on-zero-touch-media).
## Check the result
* On **Start**, **Zero-Touch** under **Domain Join** reads **Configured**, not **Needs attention**.
* On a deployed device, follow the hand-over checks of the [Domain Join step](/foundry-deploy/domain-join.md).
## Limits
* Media keeps the accounts and passwords it was created with. Create or update it after you change one.
* Foundry OSD does not check the account with the domain, because the media may be created on a computer that cannot reach it. The check runs in Foundry Deploy.
* A join password is limited to 2,560 bytes: 2,560 characters if all are plain ASCII; other characters count 2 to 4 bytes.
* An [exported file](/foundry-osd/configuration-sharing/export-and-import.md) or a [publication](/foundry-osd/configuration-sharing/publish-to-a-folder.md) contains the join passwords only when **Include passwords** is selected.
## Related
* [Domain Join](/foundry-osd/domain-join.md): the two modes and their requirements
* [Domains and OUs](/foundry-osd/domain-join/domains-and-ous.md)
* [Security and credentials](/reference/security-and-credentials.md)
* [Domain Join troubleshooting](/troubleshooting/domain-join.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.foundryosd.com/foundry-osd/domain-join/zero-touch.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
