Add one-command server and client bootstraps

scripts/Enroll-SguDomainClient.ps1

@@ -75,6 +75,14 @@ $guardParams = @{
 }
 
 if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before joining the domain')) {
+    # The broker uses a domain DNS name even before the machine joins the
+    # domain. Point at AD DNS first so the provider-first health check works on
+    # a completely clean Windows installation.
+    Set-DnsClientServerAddress `
+        -InterfaceAlias $NetworkInterfaceAlias `
+        -ServerAddresses $DomainDnsServerAddresses
+    Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
+
     & (Join-Path $PSScriptRoot 'Install-CredentialProvider.ps1') @installParams | Out-Null
     & (Join-Path $PSScriptRoot 'Install-SguEnrollmentGuard.ps1') @guardParams | Out-Null
 
@@ -94,11 +102,6 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install and verify SGU before jo
             -RemoteDesktopPrincipal $RemoteDesktopPrincipal
     }
 
-    Set-DnsClientServerAddress `
-        -InterfaceAlias $NetworkInterfaceAlias `
-        -ServerAddresses $DomainDnsServerAddresses
-    Resolve-DnsName -Type SRV "_ldap._tcp.dc._msdcs.$DomainName" -ErrorAction Stop | Out-Null
-
     if (-not $DomainCredential) {
         $DomainCredential = Get-Credential `
             -UserName "$DomainNetbios\Administrator" `