Offline join domain, reboot and add security groups.

Hi all, I have a task to join a bunch of computers to the domain, reboot and add a couple of security groups to them. I’d like to do this from one script and have the script reboot the machine then carry out the additional security group task. 2 questions, would workflow module be best for the reboot and continue script action and is there another way to add adgroups without having to install the rsat (admodule)tools on every device?