I have a need to restart the puppet service when the machine is joined to the domain (otherwise the puppet service can't resolve Active Directory users and groups until a restart), so need to first have the puppet service managed in order to notify it