I found this.


It looks like what you already know - you need to suppy credentials with domain-joining rights.

Pretty poor if you ask me, it seems a reasonable & common thing to do for notebook users.

-Zeke