Domain Join and Basic troubleshooting

In our tech-savvy age, networks are all the rage 🌐; 

Joining a domain, though, can sometimes feel like a cage 🖥️.  

It makes managing PCs a breeze, with security and ease 🔒, 

But troubleshooting woes can bring you to your knees 😩. 

I'm Siyao Li, aka Janet, here to lend a hand 🙋‍♀️  ,  

With tips and tricks to make your network grand 💡  .  

For IT pros and admins, it'll be worth your while 🧑‍💻,  

Dive into the basics, and you'll soon smile! 😄🔐

Section 1: Prerequisites to Perform a Domain Join  

(Note: These prerequisites primarily apply when performing a domain join over a network. For information on performing an offline domain join, please refer to this document: Offline Domain Join (Djoin.exe) Step-by-Step Guide | Microsoft Learn.)  

1-1.  Network Connectivity 

The device should be capable of communicating with a Domain Controller over the network. If the device is remote, a VPN connection to the corporate network is necessary.  The device must use the corporate DNS server, typically provided by the Domain Controller. 

To test if you can discover a domain controller, run the following command: 

nltest /dsgetdc:contoso.com /force

(replace “contoso.com” with the domain name the client wishes to join) 

Working example  

C:\Users\Administrator-W11>nltest /dsgetdc:contoso.com /force
DC: \Cont-DC.contoso.com  
Address: \192.168.2.100 
Dom Guid: 53fbff01-6803-43c1-ba6c-b5c288951db7 
Dom Name: contoso.com 
Forest Name: contoso.com 
Dc Site Name: Default-First-Site-Name 
Our Site Name: Default-First-Site-Name 
Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST 
The command completed successfully

Explanation of Key Details: 

DC: The domain controller that was found (Cont-DC.contoso.com). 
Address: The IP of the DC. 
Dom Guid: Unique identifier for the domain. 
Flags: Lists the DC’s capabilities (e.g., PDC = Primary Domain Controller, GC = Global Catalog, DS = Directory Services, etc.). 
Our Site Name: Shows which Active Directory site the client is in. 

Non-working example  

C:\Users\Administrator-W11>nltest /dsgetdc:contoso.com /force  
Getting DC name failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN 

Ensure that firewall rules allow traffic to domain controllers. Additionally, Windows Defender or third-party antivirus software should not obstruct domain join requests. It is essential to confirm that the following ports are open: Configure firewall for AD domain and trusts - Windows Server | Microsoft Learn: 

Port 

Protocol 

Application Protocol 

 System Service or Process

53 

TCP 

DNS 

DNS Server 

53 

UDP 

DNS 

DNS Server 

389 

UDP 

DC Locator 

LSASS 

389 

TCP 

LDAP Server 

LSASS 

88 

TCP 

Kerberos 

Kerberos Key Distribution Server 

135 

TCP 

RPC 

RPC Endpoint Mapper 

445 

TCP 

SMB 

LanmanServer 

1024-65535 

TCP 

RPC 

RPC Endpoint Mapper for DSCrackNames,  

SAMR and Netlogon calls between Client and Domain Controller 

1-2. Computer Name Requirements 

• • Adhere to Active Directory naming conventions for computers as outlined here. 

• • Assign a unique hostname to the device to prevent conflicts, otherwise, if there is an object with the same name already exist in active directory, domain join will fail or encounter problem (see section 3-2 for more details). 

• • Please be aware of the domain join hardening when reusing an existing computer account in the target domain KB5020276—Netjoin: Domain join hardening changes - Microsoft Support  

1-3. User credentials 

By default, Active domain allows authenticated users to join 10 machine accounts to the domain. This default was implemented to prevent misuse. But an administrator can make a change to an object in Active Directory to override it. Default workstation number a user can join to the domain - Windows Server | Microsoft Learn 

The following users aren't restricted by this limitation: 

• • Users in the Administrators or Domain Administrators groups. 

• • Users who have delegated permissions on containers in Active Directory to create and delete computer accounts. 

Please note: Windows Home editions cannot join a domain. 

Section 2: Understand The Workflow of Domain Join Process

2-1.  Domain Controller Discovery (Finding a DC) 

Before a computer can join a domain, it must locate an available Domain Controller (DC). This is done using DNS because Active Directory (AD) relies heavily on DNS to locate resources. 

The client queries its configured DNS server for a Service (SRV) record in the format:

  _ldap._tcp.dc._msdcs.<domain-name> 

Network trace example

153	2025-01-06 16:47:52.116646	9.320329	192.168.2.106	192.168.2.100         92	DNS		_ldap._tcp.dc._msdcs.contoso.com	Standard query 0x4fbe SRV _ldap._tcp.dc._msdcs.contoso.com
154	2025-01-06 16:47:52.117503	0.000857	192.168.2.100	192.168.2.106        202	DNS		_ldap._tcp.dc._msdcs.contoso.com	Standard query response 0x4fbe SRV _ldap._tcp.dc._msdcs.contoso.com SRV 0 100 389 cont-dc.contoso.com SRV 0 100 389 Cont-DC.contoso.com A 192.168.2.100 A 192.168.2.100

This record points to all Domain Controllers within the domain. The DNS server returns a list of available DCs. 

Network trace example 

Queries
        _ldap._tcp.dc._msdcs.contoso.com: type SRV, class IN
            Name: _ldap._tcp.dc._msdcs.contoso.com
            [Name Length: 32]
            [Label Count: 6]
            Type: SRV (33) (Server Selection)
            Class: IN (0x0001)
    Answers
        _ldap._tcp.dc._msdcs.contoso.com: type SRV, class IN, priority 0, weight 100, port 389, target cont-dc.contoso.com
            Service: _ldap
            Protocol: _tcp
            Name: dc._msdcs.contoso.com
            Type: SRV (33) (Server Selection)
            Class: IN (0x0001)
            Time to live: 600 (10 minutes)
            Data length: 27
            Priority: 0
            Weight: 100
            Port: 389
            Target: cont-dc.contoso.com
        _ldap._tcp.dc._msdcs.contoso.com: type SRV, class IN, priority 0, weight 100, port 389, target Cont-DC.contoso.com
            Service: _ldap
            Protocol: _tcp
            Name: dc._msdcs.contoso.com
            Type: SRV (33) (Server Selection)
            Class: IN (0x0001)
            Time to live: 600 (10 minutes)
            Data length: 27
            Priority: 0
            Weight: 100
            Port: 389
            Target: Cont-DC2.contoso.com
    Additional records
        cont-dc.contoso.com: type A, class IN, addr 192.168.2.100
            Name: cont-dc.contoso.com
            Type: A (1) (Host Address)
            Class: IN (0x0001)
            Time to live: 3600 (1 hour)
            Data length: 4
            Address: 192.168.2.100
        Cont-DC.contoso.com: type A, class IN, addr 192.168.2.101
            Name: Cont-DC2.contoso.com
            Type: A (1) (Host Address)
            Class: IN (0x0001)
            Time to live: 3600 (1 hour)
            Data length: 4
            Address: 192.168.2.101

The client selects a DC, The client attempts a lightweight connection (UDP 389 - LDAP Ping) to the selected DC to verify availability and in the DC’s response to obtain its capabilities and to discover the client site. 

Network trace  

370	2025-01-06 16:48:14.757398	0.000570	192.168.2.106	192.168.2.100    196	CLDAP	 searchRequest(22) "<ROOT>" baseObject        
371	2025-01-06 16:48:14.757916	0.000518	192.168.2.100	192.168.2.106     214	CLDAP	 searchResEntry(22) "<ROOT>" searchResDone(22) success  [1 result]

If the selected DC does not respond, the client tries another DC from the DNS response.  

2-2.   LDAP Binding & Machine Name Verification 

The client initiates an LDAP Bind (using Kerberos authentication) to the DC. Then client performs an LDAP Search under the CN=Computers or another designated OU (Organizational Unit) to check if its computer name already exists in Active Directory. If a computer account with the same name already exists, the account will either be reused successfully or the domain join operation will fail (see section 3-2 for details). Once the operation is completed successfully, the process will continue. 

2-3. Computer Account Creation in AD (LDAP Add/Modify Operation) 

Once the machine name is verified, the DC must create or update the existing computer account in Active Directory. 

The client initiates an LDAP Add or Modify request to create a computer account in the designated OU, defaulting to CN=Computers, <domain> unless otherwise specified by policy or administrative configuration. A unique Security Identifier (SID) is assigned to the new object, and the client generates a machine password, which is stored both locally in the registry of the workstation and the account in the Active Directory, with automatic rotation every 30 days by default. The client finalizes the process by updating its local registry.

Section 3: Frequent Causes of Domain Join Failures  

Based on the experience working with customers who encounter domain join failures, the three major common issues are as follows: 

3-1. Networking related issues  

Numerous networking issues can lead to the failure of a domain join. Chief among these is the blockage of necessary ports between the client and the Domain Controller (DC). It is observed that more than 50% of domain join failure cases we have worked with are attributable to ports not being open between the client and the Domain Controller. A commonly blocked port is UDP 389, which is crucial for communication between the client and the selected DC to verify availability and obtain capabilities. Often, customers check TCP port 389 to ensure it is open but overlook UDP port 389, both of which are required during the domain join process. The client first sends an LDAP Ping via UDP port 389 to discover a Domain Controller. Once a DC responds, the client initiates a connection on TCP port 389 for authentication and LDAP queries.  

For this type of issue, you will see domain join error like this: “The specified domain either does not exist or could not be contacted” 

Blocked ports like TCP 445 (SMB), TCP 88 (Kerberos), and ephemeral ports can cause domain join failures.  To prevent this type of issue, we should make sure the following ports are open before performing domain join .

Port 

Protocol 

Application Protocol 

53 

TCP 

DNS 

53 

UDP 

DNS 

389 

UDP 

DC Locator 

389 

TCP 

LDAP Server 

88 

TCP 

Kerberos 

135 

TCP 

RPC 

445 

TCP 

SMB 

1024-65535 

TCP 

RPC 

To check if TCP port is open, you can run PowerShell command: 

Test-netconnection con-dc.contoso.com -port number

Working Example  

PS C:\Users\Administrator-W11> Test-netconnection Cont-DC.contoso.com -port 389
ComputerName     : Cont-DC.contoso.com
RemoteAddress    : 192.168.2.100
RemotePort       : 389
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.2.111
TcpTestSucceeded : True

Non-working Example : 

PS C:\Users\Administrator> Test-netconnection Cont-DC.contoso.com -port 445
WARNING: TCP connect to (192.168.2.111 : 445) failed
WARNING: Ping to 192.168.2.111 failed with status: TimedOut
ComputerName           : Cont-DC.contoso.com
RemoteAddress          : 192.168.2.100
RemotePort             : 445
InterfaceAlias         : Ethernet 2
SourceAddress          : 192.168.2.111
PingSucceeded          : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded       : False

To test UDP ports, PowerShell's Test-NetConnection command is not suitable as it primarily supports TCP connections. Instead, we recommend using PortQryUI, which offers features specifically designed for querying UDP connections. This tool provides a more effective solution for testing and troubleshooting UDP connectivity. Download PortQryUI - User Interface for the PortQry Command Line Port Scanner from Official Microsoft Download Center

You can test using command: 

portqry -n DC01 -p UDP -e 389 (replace DC01 to your DC’s FQDN)

For example, 

C:\Users\Administrator>cd C:\PortQryUI
C:\PortQryUI>portqry -n cont-dc.contoso.com -p UDP -e 389
Querying target system called:
cont-dc.contoso.com
Attempting to resolve name to IP address...
Name resolved to 192.168.2.100
querying...
UDP port 389 (unknown service): LISTENING or FILTERED
Using ephemeral source port
Sending LDAP query to UDP port 389...
LDAP query response:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=contoso,DC=com
ldapServiceName: contoso.com:cont-dc$@CONTOSO.COM
isGlobalCatalogReady: TRUE
supportedSASLMechanisms: GSSAPI
supportedLDAPVersion: 3
supportedLDAPPolicies: MaxPoolThreads
supportedControl: 1.2.840.113556.1.4.319
supportedCapabilities: 1.2.840.113556.1.4.800
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=contoso,DC=com
serverName: CN=CONT-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=contoso,DC=com
schemaNamingContext: CN=Schema,CN=Configuration,DC=contoso,DC=com
namingContexts: DC=contoso,DC=com
isSynchronized: TRUE
highestCommittedUSN: 329631
dsServiceName: CN=NTDS Settings,CN=CONT-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=contoso,DC=com
dnsHostName: Cont-DC.contoso.com
defaultNamingContext: DC=contoso,DC=com
currentdate: 02/28/2025 18:14:50 (unadjusted GMT)
configurationNamingContext: CN=Configuration,DC=contoso,DC=com
======== End of LDAP query response ========
UDP port 389 is LISTENING

For more networking related issue causing domain join fail, please visit Troubleshoot errors that occur when you join Windows-based computers to a domain - Windows Server | Microsoft Learn 

3-2. Hostname of the client is not unique.   

3-2-1. There is an existing computer account with the same name in the domain AND the account you used to join the domain is the one of the exempted users in domain join hardening.   

For example: 

A new workstation named Cont-W10 (referred to as computer A) has been provisioned, and you are using Domain Admin account who created this object attempting to join it to the domain contoso.com. There is another computer object also named Cont-W10 (referred to as Computer B) that currently exists in the active directory. If you try to join the domain, it will permit you to join the domain but will disrupt the secure channel between computer B (Cont-W10) and the Domain Controller (DC). Upon its next reboot, computer B will encounter an error: The trust relationship between this workstation and the primary domain failed.  

This happens because when a client joins the domain, it generates a new machine password, which is then stored in the corresponding computer object in Active Directory. Since the existing Cont-W10 object is updated with the new password, the previous Computer B's locally stored password will no longer match the one in Active Directory, breaking its secure communication with the DC. 

3-2-2. There is an existing computer account with the same name in the forest.  

For example: 

When attempting to join a workstation named Cont-Win11 (Computer C) to the domain child.contoso.com, the operation fails because another computer object, Cont-W11 (Computer D), already exists in the parent domain contoso.com. This results in the error: "The operation failed because SPN value provided for addition/modification is not unique forest wide." During the domain join process, the Netlogon service on the client registers Service Principal Names (SPNs) in Active Directory, including the HOST/ComputerName format. Since SPNs must be unique across the entire Active Directory Forest, the attempt to create HOST/Cont-Win11 fails due to the existing entry for Computer D in the parent domain, preventing the domain join from completing successfully. 

To resolve this issue, you have two options: 

• • Delete the existing computer object in the parent domain (contoso.com) if it is no longer needed. This will remove the conflicting SPN, allowing the new workstation (Cont-Win11) to join the child domain successfully. 
  • Rename the new workstation before attempting the domain join again. Choosing a unique name will prevent SPN conflicts and allow the workstation to be added without issues. 

To Prevent name conflict when joining the domain , you can search the computer name you plan to use in the global catalog  

3-3. Domain Join Hardening Changes  

       KB5020276—Netjoin: Domain join hardening changes - Microsoft Support 

KB5020276 introduces domain join hardening changes to improve security by preventing unauthorized or unintended computer account takeovers during domain join operations. Before this update, if a computer with the same name already existed in Active Directory, joining a new machine with the same name could overwrite the existing object, potentially breaking its secure channel with the Domain Controller (DC). With this update, additional validation is enforced to ensure that only users with the proper permissions can reset or reuse an existing computer account. If the required permissions are missing, the domain join will fail with an error: An account with the same name exists in Active Directory. Re-using the account was blocked by security policy. 

To successfully join a machine to the domain, administrators must either delete the existing computer object, have the necessary permissions to reuse it, or use a different unique name for the new machine. 

If you want to dive deep troubleshooting domain join failures, capture a network trace and examine the Netsetup.log file. Netsetup.log is an important resource for diagnosing domain join issues and can be found at C:\Windows\Debug\netsetup.log. Review the log to identify error messages and search the Microsoft website for relevant articles or known solutions. For more information: Active Directory domain join troubleshooting guidance - Windows Server | Microsoft Learn