Don’t forget that the machine account in AD has a password, this gets changed on a regular basis, this happens invisibly, it is a function of the way AD words.
From memory it gets changed every 30 days, and as I say is completely invisible to users and admins, the last changed date can be read from AD via LDAP, although it needs a bit of work to translate it into human readable format.
If you image a PC without sysprep, when you deploy that image it will not join the domain if the machine account password has changed.
This will need the PC to be deleted and re-added to AD to resolve.