feature: enrol devices bound to another domain

2025-09-18 18:27:29 +10:00
1 parent deaac0f073
commit 356762c811
@@ -205,6 +205,10 @@
    <Compile Include="Migrations\202509070209304_DBv29.Designer.cs">
      <DependentUpon>202509070209304_DBv29.cs</DependentUpon>
    </Compile>
+    <Compile Include="Migrations\202509180416385_DBv30.cs" />
+    <Compile Include="Migrations\202509180416385_DBv30.Designer.cs">
+      <DependentUpon>202509180416385_DBv30.cs</DependentUpon>
+    </Compile>
    <Compile Include="Migrations\Configuration.cs" />
    <Compile Include="Migrations\DiscoDataMigrator.cs" />
    <Compile Include="Properties\AssemblyInfo.cs" />
@@ -307,6 +311,9 @@
    <EmbeddedResource Include="Migrations\202509070209304_DBv29.resx">
      <DependentUpon>202509070209304_DBv29.cs</DependentUpon>
    </EmbeddedResource>
+    <EmbeddedResource Include="Migrations\202509180416385_DBv30.resx">
+      <DependentUpon>202509180416385_DBv30.cs</DependentUpon>
+    </EmbeddedResource>
    <EmbeddedResource Include="Properties\Resources.resx">
      <Generator>ResXFileCodeGenerator</Generator>
      <LastGenOutput>Resources.Designer.cs</LastGenOutput>
@@ -0,0 +1,27 @@
+// <auto-generated />
+namespace Disco.Data.Migrations
+{
+    using System.Data.Entity.Migrations;
+    using System.Data.Entity.Migrations.Infrastructure;
+    using System.Resources;
+    
+    public sealed partial class DBv30 : IMigrationMetadata
+    {
+        private readonly ResourceManager Resources = new ResourceManager(typeof(DBv30));
+        
+        string IMigrationMetadata.Id
+        {
+            get { return "202509180416385_DBv30"; }
+        }
+        
+        string IMigrationMetadata.Source
+        {
+            get { return null; }
+        }
+        
+        string IMigrationMetadata.Target
+        {
+            get { return Resources.GetString("Target"); }
+        }
+    }
+}
@@ -0,0 +1,17 @@
+namespace Disco.Data.Migrations
+{
+    using System.Data.Entity.Migrations;
+
+    public partial class DBv30 : DbMigration
+    {
+        public override void Up()
+        {
+            AddColumn("dbo.DeviceProfiles", "ProvisionFromOtherDomain", c => c.Boolean(nullable: false, defaultValue: false));
+        }
+
+        public override void Down()
+        {
+            DropColumn("dbo.DeviceProfiles", "ProvisionFromOtherDomain");
+        }
+    }
+}
@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="Target" xml:space="preserve">
+    <value>H4sIAAAAAAAEAO1925Ict47g+0bsPyj6aXciRi3JsiyfkGdCbkl2ayS1TrdsP3akqtjdOc7KLGdmyerza/uwn7S/sGReeQF4S+alSvVwfNRFEARAJAiSIPD//s//ffGfXzfJgy8kL+Is/enk8cNHJw9IusrWcXr708muvPn35yf/+R//83+8eL3efH3wewv3HYOjPdPip5O7stz+4/S0WN2RTVQ83MSrPCuym/LhKtucRuvs9MmjRz+ePn58SiiKE4rrwYMXl7u0jDek+oP+eZalK7Itd1HyPluTpGh+py1XFdYHH6INKbbRivx08iouVtnDV1EZPbwk26yIyyy/P3nwMokjSswVSW5OHmyf/uO3glyVeZbeXm2jMo6ST/dbQttvoqQgDen/2D61pf7RE0b9aZSmWUnRZakX9ycdX5Sz11QC5T0jq+LupxMqhJv4dpdX+M9LIoDTDv9F7oUf6E8f82xL8vL+ktw0SK5W9JeTB6dmSIpOhntxKo/R9RPRM6rpH2VOteTkwZv4K1m/I+ltedcJ+H30tf3lOVWV39KY6hTtU+Y72vphlyTR54R04KfaUStSJx7z9yjZuXJK/6kZtv6bH/XFaa8EWtV4la12G5KWn8hmm0Ql8dGM87X7dLM+ThL4brDcX5Filcfb+htzGvvJ94MH91HvZ0MHfRMnJclff93mpCjc2XZVOpWAi/QXkhJqd8isRJxvtllevizLaHXHlH0BxNBFJH+TRLeXu4QUk1NBRy5Lkr7J8k079s9ZlpAo9fiqvsQrUryL0z/J+pc8220n54bJclYCzotf4/WapM6y/BB9iW+rVVnC+Db7fLX7XHkWJw8uSVLBFHfxtvZDHspm+1ro8CbPNpdZAph3Hu76KtvlK2aUMgvgT1F+S0rPVaZHFGZ9AcHoIGyESVajJ4MXBI5ap5G/n28ZfPzInWtUw3trPLKWt4prpeXtJ2HLRW39zjJq01OKE2FDBEK5wMFUJjSwrjzQvv/ckR0yB20rRjXUrpALAnnQWVkQhErWpiFSboZoVGA8SESlqKHNRJeRJnt3X9Sb6b3987T87glgNui++oput0nrL64/Mg8lT1lfUnFh54hUu3zNcDbL+VgW0mbss6wo20FfkVW8iZKTBx9z+q/mGOX5yYOrVcTQQWJ0s1uVsDQmq2q/Vm2cbLNgOMRoIcAen5reQxpudBX/yMJAD/gq69k4qC/S9zv6fvB39D5KdzfRqtzlJHf27QYPXn9Xc4xar5BOIz8dOvArchPtkvIj/VruooK8YsdIrQmj//4UbzxQ1p+anzF0IPqPKM+jtLynrV/itbOuhJLdJdlGcT4ZESH82YGLA2xcDSuJGxs66q+FFVCmmW9FljEBJIBP5nUkT/I4Sj7sNp+ZzjifuAu93U4mB29/XxYFKb3GHvzJvctWUfBDYHujFsZDZZjojzdxQsxLuQ2yn6NydReErFfZJopT94ONoeKlKhXfpmTNjgOnH/1dVJQfSPl3lv/5LrvN0hCr4Mskyf7+LY125R3zuFbMC3ud5lnnW/ge2p7lhOEy0WiFqyIoMSOzFWKFL4wPsco2m7g65w9DHo/xkkQFZ0PqlUVuLoauxKYdmsMyBi+44ErnRmNjhjRUNhDX3bIsEyoBIEuuDOV3WFcZOg2xVTtOqtCMECrCuJLJ2zHd1ItwytzzzdjkCzB+s8+61mg2BodRhGzEoxIOgiGChmH99OIVKaM40TFQQ6CEC80IwSKMH6H9ybmO2B4KJVgBQYhW4TyPyekv8U21jGnPbHowlHQVBjsiVwGDHeo2+Op25ftjP2PfXdXm972xS2O7702EREUJgiHShGG9L01MHFzLkMgC1wLo17gOKsBZXbvmHdBpHfvvBBeC8ib0LstLr6HnuwcdfjrZnPpc5LdRGheV8r9cr1lMyqD9Fzsx2dFZZ391AV0hgyHsBBsXdKzPO8aVcBxZfdhSY+GMnhdalFBSy6As2sj5dXqT5fUBVSvusyz9wr6zzD0IBEaOs+mLuDpdZHuTl69erlbZLg2HkdnlC7pJzeu9/1C8vFvKTmuSl+vNcKxXpOQRv8nyaqM+mNh6k071pqBm95LEm+iW0AW+2seyBecAIqx4uc1KCOfOtYflrtFzwy9aOCJe7kq6gMX9/cH01PwR5yShK0fjkkxIyIDjd+cTAdizw84NBnh29fHAt+3XDXdwbO8C7Qz3brtN4hnucTsu2qOBiaXIVv0x70AZ/n/uokaNBh38V/5suAuO9lr29yiJ13RxjROdFrlg9JvLADHCabHLwxxDV6iidEVm+zAaZoJMTMfNXDPTHy9MPPA37dhpnAfZllgc1qtdsHN7GRLxLFBwv1O7Cp3dwa0Eei3cWoBcwcC6uwmkh99BnpEZ28sU/UyE9fB6CRySr2d3lW/ldH0iq7vwN+m2z9ZIGtprtRr5PV2/PCLoAozMVs6ijDbbwd6y53Lm4a2GuGgNYeg0dsNgGm0Zaj8GB276LiZWWkhLPjrwQaawIs3D8rUmwdX6zWRKXsXFNonuPfbAw53kq13uYcWGj/tL/IWks3D88S5LiVdQ3/CHE683dPMgXaLYDu4e/IVaCqbnukiCvv1atg5Sk+K/ye2u3loVLGFwQUUYkESpGSRThvFzLL1DS/SRMRpguzATMLJmcDRBhU2OJeh+VBaHvsV1MWufnptEq8KB+gCAgDoBwfmosDZuoMIqQknC5BthoQoQgxfZ+osNt9TCgeDj5maZafH2yZkRICTBPSdMgEGnSApj+rKGLljQ1wQtaN7f0mFu2ueJVz/u74/7e8fjailxQtgUTjYU/Bql68RDZUMNTG0JyUm68sjaEYgClpxuqauE474BWi2wvUWQcxppAOiABgEx0ao9ktHuc+TsaxZ0q31Q+pVUJwY+FPgAp+3i3sln3a7x6N46gt3aXVp94+q68EODTv9EkmNg4Kox7+O439LIkhk3e2T5VCbY8QB8QmtzoOB28jHWKxor+qUXAF7f/tvs8yG56DMm6xrTDNkm15veYFxs6VytZ9yj1ASEeSD7dUtWVOvOkqwIEwBUYxpHOvbjh+CEHQr2O5nW23kfpdEtYcaoafeJq/mVJOuh5PWY5hN2T4Nn4oLhdys1CZckWt+/yeguqNzlaRjRijjnFnJNRai34jzG+Tj7I4pLOhCVcbXMr3gFGu6AGXLyXXftSr479rPij/Btrp6TKSGYQwo+hCxtsq9BTp32DSmSf0a4FQqygdfcPkEXOn4UiCs7OlMymDhZYis4XxKI65SJSyxKpgwmkim2gmRKIH6axS9QKKkQqEiuCgGSDID5kQ0bfwMDWCeIFRhWwxTSwZc90fYbGZPBYZZEKC0zEqiHRTXFCwggzCBIVIuNUG5TCcLjOt2QrYyHACgU2iACRQAP+t5ltyhltA2gqfkVoqZtGifJb7PQQfl9myY0tW/b7kHYe1JG3SsAjD4BCCBSaYcoVYE8yW1fk+iobWEQYvlmjFYBxpPUD1lqQy0HhhAsQWA0y2CDcuO1/uPkZ0n7no3d2Y03+c6VT+6QXhtYlxSYoUeMhxkPQBk7Bu8fL/ePl/vHy/1JL/erVX+4jw8YfmQXEORWX0SPbJ5s7vQRsFGu9MWxdDf6ekgDE2Hv8/m90HG9Xcp6O2caq4mKVWgMk/3OHvhS4K1/KKvUY0eMkgqgJzLMw6/6DOH4/S7l+53dd/TJ+ObzqeqPugDNl0/BQn2YDC/ySfJNGEnBPsP22OzAvsWKraEfZIBv+uV6HSp2jmGayTxUYzdf9uTZQS7JJvsS5jq8QTXPHXgz+FxivHr38vXXbZyTIoQkP+ZxlXFOiJppv7u+cYgJr1DpqwG2xguuBdi14pUAexCPc+2hlxiAaQcvOazjUFsLYSSMg4TJ6wC0RPZQrqRyH6KRWAEWJpcD0RLMwwVZOA9p1fzgfl4a4MnhnDvH85VH/Z2hDLNBz7KEaqmzsIfLukok1a4Ew7LtBVoB5FVq9/m/yao8X0+QCG3IRZR7NVrMLg2K6eIWwBDrJEqjupT6mk3xmt3DfDZOuasFDeDLv8uK4iJ/FbHUyiF8qNcsV7dvHbAA4bS+hne4L/rpLs7pAkV/OIt2BenmxTc5tYzPYykbLlCZiD/uXF/wPwuQhrlMSVGQgv1ZNIloiHMqmuHC+HmX3yZRfv/pjtyU9Ju/y9YXN9Qe5K4yCZAPqPmTlfW6IiRITbSPWRKvyIeMZeAerr4itqtyHoMgUhFeSmc5RXFJtqzURubI3dPB3F2SFXX980uy3q2IGIBuScPzwTRUxQno2kPoV1l56HkZO3+cAW7Z6XRe3LRppYc/A4rizZss31zR1SzMuyIO4TxHNXVm4bkyGvdBAOMT4HO+4R4ECfiVeKSkfXC8pCd29ALdNNQr0GZe1C4hfOYuenKvXObXX9kZRJQEP1uw8q+bwd9lt7dhFrQWo+8HGo4ndiGbEIvqqUG/epdgYuQ7AYN3h3wYfGTxXn0b50VnMyqTMdSLbMopUT08u2NyvSR/7eJAyf4x3PMszzI1Vpds3oiXwePHKB6FRYZ3Hg5bB/QiX1OXJ4oDPeYG0C6BP2+XLiQVoVx0BelcbvqXrHpitiJxoBtiCeVcN8XbiFrXfBavqR08nNfUYpzPa2opGMlr0q2Otq+d9Di0z6B0XTE3zLq/8yU0toT6CgK7q7bu5yMC/5ttbH31Zb/v78R9282H+a6vK+/I0mvLOtpdyznSy4ZxrOsgvm1OI1AiNGcSxj7OHGvPJ3T8AoukLbdgVy2vQA8bTqFuHk/Pwz5WtaB78LaYcSpmOT+kIJWWu6Gb7zkDKfc+HPSwIjLDsTFTHrS5KgdepL2Nef11y66aqZ28JMUumT689SJt03vOQ46x0IVLdYsa3ljhgv0EZtPFYH2KdISuymFJb+DoV2AUcGOhg7MhfbyQWGAwJDJWD2nDhSlO1syHOxvWXLgxMfwCrvsgD8iNOsb6HnqsL9PaWYv6Line truncated
+  </data>
+</root>
@@ -36,7 +36,7 @@ namespace Disco.Models.Repository

        // 2012-06-28 G#
        public bool ProvisionADAccount { get; set; }
-
+        public bool ProvisionFromOtherDomain { get; set; }
        public bool AssignedUserLocalAdmin { get; set; }
        public bool SetAssignedUserForLogon { get; set; }

@@ -226,40 +226,46 @@ namespace Disco.Services.Devices.Enrolment
                        throw;
                    }
                }
+
+                int deviceProfileId;
+                if (response.DeviceProfileId.HasValue)
+                    deviceProfileId = response.DeviceProfileId.Value;
+                else if (device != null)
+                    deviceProfileId = device.DeviceProfileId;
+                else
+                    deviceProfileId = Database.DiscoConfiguration.DeviceProfiles.DefaultDeviceProfileId;
+                var deviceProfile = Database.DeviceProfiles.Find(deviceProfileId)
+                    ?? throw new InvalidOperationException($"Device profile {deviceProfileId} was not found, please check your default profile configuration");
+
                if (Request.IsPartOfDomain && !string.IsNullOrWhiteSpace(Request.ComputerName))
                {
-                    EnrolmentLog.LogSessionProgress(sessionId, 20, "Loading Active Directory Computer Account");
-                    Guid? uuidGuid = null;
-                    Guid? macAddressGuid = null;
-                    if (!string.IsNullOrEmpty(Request.Hardware.UUID))
-                        uuidGuid = ADMachineAccount.NetbootGUIDFromUUID(Request.Hardware.UUID);
+                    if (ActiveDirectory.Context.TryGetDomainByName(Request.DNSDomainName, out domain))
+                    {
+                        EnrolmentLog.LogSessionProgress(sessionId, 20, "Loading Active Directory Computer Account");
+                        Guid? uuidGuid = null;
+                        Guid? macAddressGuid = null;
+                        if (!string.IsNullOrEmpty(Request.Hardware.UUID))
+                            uuidGuid = ADMachineAccount.NetbootGUIDFromUUID(Request.Hardware.UUID);

-                    // Use non-Wlan Adapter with fastest speed
-                    var macAddress = Request.Hardware?.NetworkAdapters?.Where(na => !na.IsWlanAdapter).OrderByDescending(na => na.Speed).Select(na => na.MACAddress).FirstOrDefault();
-                    if (!string.IsNullOrEmpty(macAddress))
-                        macAddressGuid = ADMachineAccount.NetbootGUIDFromMACAddress(macAddress);
+                        // Use non-Wlan Adapter with fastest speed
+                        var macAddress = Request.Hardware?.NetworkAdapters?.Where(na => !na.IsWlanAdapter).OrderByDescending(na => na.Speed).Select(na => na.MACAddress).FirstOrDefault();
+                        if (!string.IsNullOrEmpty(macAddress))
+                            macAddressGuid = ADMachineAccount.NetbootGUIDFromMACAddress(macAddress);

-                    if (domain == null)
-                        domain = ActiveDirectory.Context.GetDomainByName(Request.DNSDomainName);
+                        var requestDeviceId = $@"{domain.NetBiosName}\{Request.ComputerName}";

-                    var requestDeviceId = $@"{domain.NetBiosName}\{Request.ComputerName}";
-
-                    adMachineAccount = domainController.Value.RetrieveADMachineAccount(requestDeviceId, uuidGuid, macAddressGuid);
+                        adMachineAccount = domainController.Value.RetrieveADMachineAccount(requestDeviceId, uuidGuid, macAddressGuid);
+                    }
+                    else if (!deviceProfile.ProvisionFromOtherDomain)
+                    {
+                        throw new EnrolmentSafeException($"The specified domain name '{Request.DNSDomainName}' is not recognized or reachable.");
+                    }
                }
                if (device == null)
                {
                    EnrolmentLog.LogSessionProgress(sessionId, 30, "New Device, Creating Disco Instance");
                    EnrolmentLog.LogSessionTaskAddedDevice(sessionId, Request.SerialNumber);

-                    int deviceProfileId;
-                    if (response.DeviceProfileId.HasValue)
-                        deviceProfileId = response.DeviceProfileId.Value;
-                    else
-                        deviceProfileId = Database.DiscoConfiguration.DeviceProfiles.DefaultDeviceProfileId;
-
-                    var deviceProfile = Database.DeviceProfiles.Find(deviceProfileId)
-                        ?? throw new InvalidOperationException($"Device profile {deviceProfileId} was not found, please check your default profile configuration");
-
                    var deviceBatch = default(DeviceBatch);
                    if (response.DeviceBatchId.HasValue)
                        deviceBatch = Database.DeviceBatches.Find(response.DeviceBatchId.Value);
@@ -300,14 +306,10 @@ namespace Disco.Services.Devices.Enrolment

                    device.DeviceModel = deviceModel;

-                    if (response.DeviceProfileId.HasValue && device.DeviceProfile.Id != response.DeviceProfileId.Value)
+                    if (device.DeviceProfile.Id != deviceProfileId)
                    {
-                        var deviceProfile = Database.DeviceProfiles.Find(response.DeviceProfileId.Value);
-                        if (deviceProfile != null)
-                        {
-                            device.DeviceProfile = deviceProfile;
-                            device.DeviceProfileId = deviceProfile.Id;
-                        }
+                        device.DeviceProfile = deviceProfile;
+                        device.DeviceProfileId = deviceProfile.Id;
                    }

                    if (response.DeviceBatchId.HasValue && device.DeviceBatch?.Id != response.DeviceBatchId.Value)
@@ -34,6 +34,7 @@ namespace Disco.Web.Areas.API.Controllers
        private const string pEnforceComputerNameConvention = "enforcecomputernameconvention";
        private const string pEnforceOrganisationalUnit = "enforceorganisationalunit";
        private const string pProvisionADAccount = "provisionadaccount";
+        private const string pProvisionFromOtherDomain = "provisionfromotherdomain";
        private const string pAssignedUserLocalAdmin = "assigneduserlocaladmin";
        private const string pSetAssignedUserForLogon = "setassigneduserforlogon";
        private const string pAllowUntrustedReimageJobEnrolment = "allowuntrustedreimagejobrnrolment";
@@ -93,6 +94,9 @@ namespace Disco.Web.Areas.API.Controllers
                        case pProvisionADAccount:
                            UpdateProvisionADAccount(deviceProfile, value);
                            break;
+                        case pProvisionFromOtherDomain:
+                            UpdateProvisionFromOtherDomain(deviceProfile, value);
+                            break;
                        case pAssignedUserLocalAdmin:
                            UpdateAssignedUserLocalAdmin(deviceProfile, value);
                            break;
@@ -351,6 +355,13 @@ namespace Disco.Web.Areas.API.Controllers
            return Update(id, pProvisionADAccount, ProvisionADAccount, redirect);
        }

+        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
+        [HttpPost, ValidateAntiForgeryToken]
+        public virtual ActionResult UpdateProvisionFromOtherDomain(int id, string ProvisionFromOtherDomain = null, bool? redirect = null)
+        {
+            return Update(id, pProvisionFromOtherDomain, ProvisionFromOtherDomain, redirect);
+        }
+
        [DiscoAuthorize(Claims.Config.DeviceProfile.Configure)]
        [HttpPost, ValidateAntiForgeryToken]
        public virtual ActionResult UpdateSetAssignedUserForLogon(int id, string setAssignedUserForLogon = null, bool? redirect = null)
@@ -666,6 +677,18 @@ namespace Disco.Web.Areas.API.Controllers
            throw new Exception("Invalid Boolean Value");
        }

+        private void UpdateProvisionFromOtherDomain(DeviceProfile deviceProfile, string provisionFromOtherDomain)
+        {
+            if (bool.TryParse(provisionFromOtherDomain, out var bValue))
+            {
+                deviceProfile.ProvisionFromOtherDomain = bValue;
+
+                Database.SaveChanges();
+                return;
+            }
+            throw new Exception("Invalid Boolean Value");
+        }
+
        private void UpdateAssignedUserLocalAdmin(DeviceProfile deviceProfile, string assignedUserLocalAdmin)
        {
            if (bool.TryParse(assignedUserLocalAdmin, out var bValue))
@@ -229,6 +229,35 @@
                        </p>
                    </div>
                </div>
+                <div style="margin-top: 8px;">
+                    @if (canConfig)
+                    {
+                        <input id="DeviceProfile_ProvisionFromOtherDomain" type="checkbox" @(Model.DeviceProfile.ProvisionFromOtherDomain ? new MvcHtmlString("checked=\"checked\" ") : new MvcHtmlString(string.Empty)) />
+                        <script type="text/javascript">
+                        $(function () {
+                            document.DiscoFunctions.PropertyChangeHelper(
+                                $('#DeviceProfile_ProvisionFromOtherDomain'),
+                                null,
+                                '@Url.Action(MVC.API.DeviceProfile.UpdateProvisionFromOtherDomain(Model.DeviceProfile.Id))',
+                                'ProvisionFromOtherDomain'
+                            );
+                        });
+                        </script>
+                    }
+                    else
+                    {
+                        <input id="DeviceProfile_ProvisionFromOtherDomain" type="checkbox" @(Model.DeviceProfile.ProvisionFromOtherDomain ? new MvcHtmlString("checked=\"checked\" ") : new MvcHtmlString(string.Empty)) disabled="disabled" />
+                    }
+                    <label for="DeviceProfile_ProvisionFromOtherDomain">
+                        Provision from another Domain
+                    </label>
+                    @AjaxHelpers.AjaxLoader()
+                    <div class="info-box">
+                        <p class="fa-p">
+                            <i class="fa fa-info-circle"></i>When enabled, devices joined to another domain will be enrolled. Based on other policies this may change the domain they are bound to (eg. Provision Active Directory Account)
+                        </p>
+                    </div>
+                </div>
                <div style="margin-top: 8px;">
                    @if (canConfig)
                    {
@@ -151,6 +151,12 @@ namespace Disco.Web.Areas.API.Controllers
        }
        [NonAction]
        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public virtual System.Web.Mvc.ActionResult UpdateProvisionFromOtherDomain()
+        {
+            return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.UpdateProvisionFromOtherDomain);
+        }
+        [NonAction]
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
        public virtual System.Web.Mvc.ActionResult UpdateSetAssignedUserForLogon()
        {
            return new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.UpdateSetAssignedUserForLogon);
@@ -228,6 +234,7 @@ namespace Disco.Web.Areas.API.Controllers
            public readonly string UpdateEnforceComputerNameConvention = "UpdateEnforceComputerNameConvention";
            public readonly string UpdateEnforceOrganisationalUnit = "UpdateEnforceOrganisationalUnit";
            public readonly string UpdateProvisionADAccount = "UpdateProvisionADAccount";
+            public readonly string UpdateProvisionFromOtherDomain = "UpdateProvisionFromOtherDomain";
            public readonly string UpdateSetAssignedUserForLogon = "UpdateSetAssignedUserForLogon";
            public readonly string UpdateAssignedUserLocalAdmin = "UpdateAssignedUserLocalAdmin";
            public readonly string UpdateAllowUntrustedReimageJobEnrolment = "UpdateAllowUntrustedReimageJobEnrolment";
@@ -256,6 +263,7 @@ namespace Disco.Web.Areas.API.Controllers
            public const string UpdateEnforceComputerNameConvention = "UpdateEnforceComputerNameConvention";
            public const string UpdateEnforceOrganisationalUnit = "UpdateEnforceOrganisationalUnit";
            public const string UpdateProvisionADAccount = "UpdateProvisionADAccount";
+            public const string UpdateProvisionFromOtherDomain = "UpdateProvisionFromOtherDomain";
            public const string UpdateSetAssignedUserForLogon = "UpdateSetAssignedUserForLogon";
            public const string UpdateAssignedUserLocalAdmin = "UpdateAssignedUserLocalAdmin";
            public const string UpdateAllowUntrustedReimageJobEnrolment = "UpdateAllowUntrustedReimageJobEnrolment";
@@ -419,6 +427,16 @@ namespace Disco.Web.Areas.API.Controllers
            public readonly string ProvisionADAccount = "ProvisionADAccount";
            public readonly string redirect = "redirect";
        }
+        static readonly ActionParamsClass_UpdateProvisionFromOtherDomain s_params_UpdateProvisionFromOtherDomain = new ActionParamsClass_UpdateProvisionFromOtherDomain();
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public ActionParamsClass_UpdateProvisionFromOtherDomain UpdateProvisionFromOtherDomainParams { get { return s_params_UpdateProvisionFromOtherDomain; } }
+        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
+        public class ActionParamsClass_UpdateProvisionFromOtherDomain
+        {
+            public readonly string id = "id";
+            public readonly string ProvisionFromOtherDomain = "ProvisionFromOtherDomain";
+            public readonly string redirect = "redirect";
+        }
        static readonly ActionParamsClass_UpdateSetAssignedUserForLogon s_params_UpdateSetAssignedUserForLogon = new ActionParamsClass_UpdateSetAssignedUserForLogon();
        [GeneratedCode("T4MVC", "2.0"), DebuggerNonUserCode]
        public ActionParamsClass_UpdateSetAssignedUserForLogon UpdateSetAssignedUserForLogonParams { get { return s_params_UpdateSetAssignedUserForLogon; } }
@@ -727,6 +745,20 @@ namespace Disco.Web.Areas.API.Controllers
            return callInfo;
        }

+        [NonAction]
+        partial void UpdateProvisionFromOtherDomainOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, string ProvisionFromOtherDomain, bool? redirect);
+
+        [NonAction]
+        public override System.Web.Mvc.ActionResult UpdateProvisionFromOtherDomain(int id, string ProvisionFromOtherDomain, bool? redirect)
+        {
+            var callInfo = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.UpdateProvisionFromOtherDomain);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "id", id);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "ProvisionFromOtherDomain", ProvisionFromOtherDomain);
+            ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "redirect", redirect);
+            UpdateProvisionFromOtherDomainOverride(callInfo, id, ProvisionFromOtherDomain, redirect);
+            return callInfo;
+        }
+
        [NonAction]
        partial void UpdateSetAssignedUserForLogonOverride(T4MVC_System_Web_Mvc_ActionResult callInfo, int id, string setAssignedUserForLogon, bool? redirect);