When capturing an image, vcld checks for the system being joined to an AD domain. If it is joined, vcld unjoins it from the domain before capturing the image. If the system is configured to be a domain controller, it cannot be unjoined from itself. So, the capture fails. A check needs to be done for the system being a domain controller before attempting to unjoin it.