Forum Discussion

nitrox2000's avatar
nitrox2000
Copper Contributor
Sep 04, 2026

Azure VM Losing Network Connectivity after Doomain Removal

I currently have Azure VM domain joined servers running Server 2019 Std which are being upgraded via an in-place upgrade to Server 2025 Std.

After the upgrade I will be un-joining from the domain and then joining a WORKGROUP to allow Entra ID joining of the servers.

I have completed this on a non-critical server but upon removing from the domain the server appears to have lost network connectivity and displays a Computer Icon with a flashing cable, then eventually fails.

I noticed the Ethernet displays now “Public” so I changed back to “Private” and removed “Network Level Authentication” from RDP.  I also removed the Custom DNS server settings that were on the NIC in Azure Portal and set to “Virtual Network Inherited” to allow Azure DNS.

Unfortunately, the same events occur time and time again with no network connectivity.  I have reset the NIC and network via Powershell and CMD commands as suggested in most Google searches along with recreating the VM NIC in Azure, but still the same!

Does anyone have any idea what could be causing the issue and how to resolve it as someone must have experienced similar in the past when unjoining an Azure VM from a corporate domain?

I have been directing all traffic from server via the Azure FW using a Route table with a route directing all traffic via Azure FW and associating the subnets being used:

Address Prefix: 0.0.0.0/0 - Next Hop type: Virtual Appliance – Next Hop IP address: <IP of Azure FW Private IP>

I assume this would remain the same too?

Please any advice or suggestions would be greatly appreciated?

 

Thanks

azure dns
azure firewall
virtual network

2 Replies

  • Jamony's avatar
    Jamony
    MCT
    Sep 07, 2026

    The 0.0.0.0/0 → Azure Firewall UDR can remain. Domain membership does not affect Azure routing, and Microsoft documents this as a normal way to force workload traffic through Azure Firewall.

     

    The most likely issue is the Windows network profile/firewall changing when the server leaves AD. Once it is no longer domain joined, the Domain firewall profile no longer applies and Windows commonly switches the NIC to Public. Any RDP or management rules that only existed for the Domain profile then stop working.

     

    I would check these immediately after the unjoin:

     

    Get-NetConnectionProfile Get-NetFirewallProfile Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select DisplayName, Enabled, Profile

     

    Then test the actual connectivity rather than relying on the network icon:

     

    Test-NetConnection 168.63.129.16 -Port 53 Test-NetConnection 8.8.8.8 -Port 443 Resolve-DnsName microsoft.com Test-NetConnection <Azure-Firewall-Private-IP>

     

    The flashing/no-internet network icon can simply mean Windows NCSI cannot complete its internet connectivity test; it doesn't necessarily mean the NIC has lost Azure connectivity.

     

    I would also temporarily enable RDP for the Private profile:

     

    Set-NetConnectionProfile -NetworkCategory Private Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

     

    I would not disable NLA permanently. That is unlikely to fix the underlying problem.

     

    Also check Azure Firewall logs immediately after the domain removal. If DNS or outbound HTTPS starts getting denied, that will normally expose the problem very quickly. Changing the NIC to Azure-provided DNS is fine provided the server no longer needs your AD DNS/private DNS zones.

     

    Finally, your Server 2025 goal is supported: Azure Windows Server VMs can use Microsoft Entra sign-in and become Microsoft Entra joined using the Azure VM Entra authentication capability.

     

    So my suspicion order would be: Windows Firewall profile → DNS resolution → Azure Firewall rules/logs → effective routes, rather than rebuilding the Azure NIC.

     

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Sep 06, 2026

    Seems related to DNS and routing dependencies tied to the Domain join being broken. Once you unjoin from the Domain, the VM defaults to Azure DNS and “Public” network profile, which combined with your forced Azure Firewall route (0.0.0.0/0 → Virtual Appliance) can block traffic if DNS or NSG rules aren’t correctly aligned. Please try to fix this by re-validating DNS, NSG, and route table settings for Entra‑joined VMs.

     

    https://learn.microsoft.com/en-us/entra/identity/domain-services/troubleshoot-domain-join