Automate direct domain enrollment across Windows versions

scripts/Enroll-SguDomainClient.ps1

@@ -18,6 +18,7 @@ param(
     [PSCredential]$DomainCredential,
     [string]$DomainName = 'lci.lasalle.mx',
     [string]$DomainNetbios = 'LCI',
+    [string]$DomainControllerDnsName,
     [string]$ComputerOuDn = 'OU=Laboratorio,DC=lci,DC=lasalle,DC=mx',
     [string]$NewComputerName,
     [string]$NetworkInterfaceAlias = 'Ethernet',
@@ -57,6 +58,31 @@ $computer = Get-CimInstance Win32_ComputerSystem
 if ($computer.PartOfDomain -and $computer.Domain -ne $DomainName) {
     throw "The computer is already joined to the unexpected domain $($computer.Domain)."
 }
+$domainMembershipHealthy = $false
+if ($computer.PartOfDomain) {
+    try {
+        $domainMembershipHealthy = [bool](Test-ComputerSecureChannel -ErrorAction Stop)
+    }
+    catch {
+        $domainMembershipHealthy = $false
+    }
+}
+if ($computer.PartOfDomain -and -not $domainMembershipHealthy) {
+    if (-not $DomainCredential) {
+        $DomainCredential = Get-Credential `
+            -UserName "$DomainNetbios\Administrator" `
+            -Message "Credential permitted to repair this computer in $DomainName"
+    }
+    $repairServer = if ($DomainControllerDnsName) { $DomainControllerDnsName } else { $DomainName }
+    Write-Warning "The computer names $DomainName but its secure channel is broken. Repairing it against $repairServer."
+    Reset-ComputerMachinePassword -Server $repairServer -Credential $DomainCredential -ErrorAction Stop
+    Restart-Service Netlogon -Force
+    Start-Sleep -Seconds 2
+    $domainMembershipHealthy = [bool](Test-ComputerSecureChannel -ErrorAction Stop)
+    if (-not $domainMembershipHealthy) {
+        throw "The secure channel to $DomainName remained invalid after repair."
+    }
+}
 
 $installParams = @{
     PublishPath = $PublishPath
@@ -133,7 +159,7 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
         throw "Domain join refused because SGU enrollment is invalid: $($preJoin.Issues -join ' ')"
     }
 
-    if ($computer.PartOfDomain) {
+    if ($computer.PartOfDomain -and $domainMembershipHealthy) {
         & (Join-Path $PSScriptRoot 'Enable-LabRemoteAccess.ps1') `
             -RemoteDesktopPrincipal $RemoteDesktopPrincipal `
             -EnableAdministrativeFirewallGroups | Out-Null