howITwork

Computer can’t join the domain? Six checks that fix it

“An Active Directory Domain Controller for the domain could not be contacted.” If a Windows PC won’t join the domain, the cause is almost always one of six things, and DNS is the first. Work through these checks in order.

Check 0: the PC can join at all

Windows Home editions can’t join a domain. You need Pro, Enterprise or Education. Check with:

Get-ComputerInfo -Property WindowsProductName

Check 1: DNS points at a domain controller

This is the cause most of the time. The PC finds domain controllers through DNS records in your internal zone. If it uses the router or a public DNS server (8.8.8.8, 1.1.1.1), it can reach the internet but can’t find the domain.

ipconfig /all                # look at "DNS Servers"

The DNS servers must be your domain controllers (for example 192.168.10.10 and 192.168.10.11). Fix it in the DHCP scope options (best, fixes every PC) or, for one PC, in the adapter’s IPv4 settings. Then:

ipconfig /flushdns
ipconfig /renew

Check 2: the domain’s records resolve

# the domain name itself
nslookup howitwork.local

# the SRV record PCs use to find a domain controller
nslookup -type=SRV _ldap._tcp.dc._msdcs.howitwork.local

The first should return your domain controllers’ IP addresses, and the second should list them by name. If the SRV lookup fails while the domain controller’s DNS service is running, check that the DNS zone exists and that the domain controller registered its records (restarting the Netlogon service on the DC re-registers them).

Check 3: the network path is open

Test-NetConnection dc1.howitwork.local -Port 389   # LDAP
Test-NetConnection dc1.howitwork.local -Port 88    # Kerberos
Test-NetConnection dc1.howitwork.local -Port 445   # SMB

All should show TcpTestSucceeded : True. If not, look for a firewall between the PC’s VLAN and the servers, or a wrong VLAN on the switch port.

Check 4: the clock is right

Kerberos refuses sign-ins when the PC’s clock differs from the domain controller’s by more than 5 minutes (the default). Check the time, date and time zone, then:

w32tm /query /status
w32tm /resync

Check 5: the account and name

  • Name already in use: if a computer account with the same name exists (an old PC), either reuse it deliberately or rename the new PC. Two PCs with one name will keep breaking each other.
  • Permission: by default, any domain user can join up to 10 computers (the ms-DS-MachineAccountQuota setting). Many organisations set it to 0; then use an account that has been delegated the right to create computer objects in the target OU.

Join with PowerShell (and choose the OU)

Add-Computer -DomainName howitwork.local `
  -OUPath "OU=Computers,OU=Lahore,DC=howitwork,DC=local" `
  -Credential HOWITWORKit.admin -Restart

Putting the computer straight into the right OU means the right Group Policies apply from its first start-up.

Related: “The trust relationship between this workstation and the primary domain failed”

This happens to a PC that was joined, usually after restoring an old snapshot or image, or after a long time offline. The PC’s machine password no longer matches the one in Active Directory. Sign in with a local administrator account (or a cached domain login) and repair it without rejoining:

Test-ComputerSecureChannel -Repair -Credential HOWITWORKit.admin

It returns True when fixed. If it can’t, remove the PC from the domain, delete or reset its computer account in Active Directory, and join again.

Quick checklist

  1. Windows edition is Pro or better.
  2. DNS servers are your domain controllers.
  3. nslookup finds the domain and its SRV records.
  4. Ports 88, 389 and 445 to a domain controller are open.
  5. Clock within 5 minutes.
  6. Unique computer name and an account allowed to join.

More IT guides · howITwork on YouTube