|
1 | 1 | --- |
2 | | -title: Troubleshoot Authentication errors that occur when you join Windows-based computers to a domain |
3 | | -description: Troubleshooting guide for Authentication related error messages that occurs when you join Windows-based computers to a domain. |
| 2 | +title: Troubleshoot Authentication Errors When Joining Windows-based Computers to a Domain |
| 3 | +description: Troubleshooting guide for authentication related error messages that occurs when you join Windows-based computers to a domain. |
4 | 4 | ms.date: 05/08/2025 |
5 | 5 | manager: dcscontentpm |
6 | 6 | audience: itpro |
7 | 7 | ms.topic: troubleshooting |
8 | | -ms.reviewer: kaushika |
| 8 | +ms.reviewer: kaushika, v-lianna |
9 | 9 | ms.custom: |
10 | 10 | - sap:active directory\on-premises active directory domain join |
11 | 11 | - pcy:WinComm Directory Services |
12 | 12 | --- |
13 | | -# Troubleshoot Authentication errors that occur when you join Windows-based computers to a domain |
| 13 | +# Troubleshoot authentication errors that occur when you join Windows-based computers to a domain |
14 | 14 |
|
15 | | -This article describes several Authentication related error messages that can occur when you join client computers that are running Windows to a domain. This article also provides troubleshooting suggestions for these errors. |
| 15 | +This article describes several authentication related error messages that can occur when you join client computers that are running Windows to a domain. This article also provides troubleshooting suggestions for these errors. |
16 | 16 |
|
17 | | -## Where to find the Netsetup.log file |
| 17 | +## Where to find the NetSetup.log file |
18 | 18 |
|
19 | | -Netsetup log file contains most information about domain join activities. The file is located on the client machine at %windir%\\debug\\Netsetup.log file. This log file is enabled by default. No need to explicitly enable it. |
| 19 | +The **NetSetup.log** file contains most information about domain join activities. The file is located on the client machine at **%windir%\\debug\\Netsetup.log**. This log file is enabled by default. No need to explicitly enable it. |
20 | 20 |
|
21 | | -## You have exceeded the maximum number of computer accounts you are allowed to create in this domain. |
| 21 | +## You have exceeded the maximum number of computer accounts you are allowed to create in this domain |
22 | 22 |
|
23 | | -### Resolution |
24 | | - |
25 | | -Make sure that you have permissions to add computers to the domain, and that you have not exceeded the quota that is defined by your Domain Administrator. |
| 23 | +Make sure that you have permissions to add computers to the domain, and that you don't exceed the quota that is defined by your domain administrator. |
26 | 24 |
|
27 | 25 | To join a computer to the domain, the user account must be granted **Create computer object** permissions in Active Directory. |
28 | 26 |
|
29 | | -> [!Note] |
30 | | -> By default, a non-administrator user can join a maximum of 10 computers to an Active Directory domain. |
31 | | -
|
32 | | -## Logon failure: The target account name is incorrect. |
33 | | - |
34 | | -### Resolution |
| 27 | +> [!NOTE] |
| 28 | +> By default, a nonadministrator user can join a maximum of 10 computers to an Active Directory domain. |
35 | 29 |
|
36 | | -Check that the domain controllers (DCs) are registered by using correct IP addresses on the DNS server, and that their Service Principal Names (SPNs) are registered correctly in their Active Directory accounts. |
| 30 | +## Logon failure: The target account name is incorrect |
37 | 31 |
|
38 | | -## Logon failure: the user has not been granted the requested logon type at this computer. |
| 32 | +Check that the domain controllers (DCs) are registered by using correct IP addresses on the Domain Name System (DNS) server, and that their Service Principal Names (SPNs) are registered correctly in their Active Directory accounts. |
39 | 33 |
|
40 | | -### Resolution |
| 34 | +## Logon failure: the user has not been granted the requested logon type at this computer |
41 | 35 |
|
42 | 36 | Make sure that you have permissions to add computers to the domain. To join a computer to the domain, the user account must be granted the **Create computer object** permission in Active Directory. |
43 | 37 |
|
44 | | -Additionally, make sure that the specified user account is allowed to log on locally to the client computer. To do this, configure the **Allow log on locally** setting in Group Policy under **Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment**. |
| 38 | +Additionally, make sure that the specified user account is allowed to log on locally to the client computer. To do this, configure the **Allow log on locally** setting in Group Policy under **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **User Rights Assignment**. |
45 | 39 |
|
46 | | -## Logon failure: unknown user name or bad password. |
| 40 | +## Logon failure: unknown user name or bad password |
47 | 41 |
|
48 | | -### Resolution |
| 42 | +Make sure that you use the correct user name and password combination of an existing Active Directory user account when you're prompted for credentials to add the computer to the domain. |
49 | 43 |
|
50 | | -Make sure that you use the correct user name and password combination of an existing Active Directory user account when you are prompted for credentials to add the computer to the domain. |
51 | | - |
52 | | -## No mapping between account names and security IDs was done. |
53 | | - |
54 | | -### Resolution |
| 44 | +## No mapping between account names and security IDs was done |
55 | 45 |
|
56 | 46 | This error is likely a transient error that is logged when a domain join searches the target domain to determine whether a matching computer account was already created or whether the join operation has to dynamically create a computer account on the target domain. |
57 | 47 |
|
58 | | -## Not enough storage is available to complete this operation. |
59 | | - |
60 | | -### Resolution |
| 48 | +## Not enough storage is available to complete this operation |
61 | 49 |
|
62 | | -This error can occur when the Kerberos token size is larger than the maximum default size. If this situation, you have to increase the Kerberos token size of the computer that you try to join to the domain. For more information, see the following Knowledge Base articles: |
63 | | -[935744 "Not enough storage is available to complete this operation" error message when you use a domain controller to join a computer to a domain](../../windows-client/windows-security/not-enough-storage-available-complete-operation-error.md) |
64 | | -[327825 Problems with Kerberos authentication when a user belongs to many groups](../windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md) |
| 50 | +This error can occur when the Kerberos token size is larger than the maximum default size. If this situation, you have to increase the Kerberos token size of the computer that you try to join to the domain. For more information, see: |
65 | 51 |
|
66 | | -## The account is not authorized to login from this station. |
| 52 | +- ["Not enough storage is available to complete this operation" error message when you use a domain controller to join a computer to a domain](../../windows-client/windows-security/not-enough-storage-available-complete-operation-error.md) |
| 53 | +- [Problems with Kerberos authentication when a user belongs to many groups](../windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md) |
67 | 54 |
|
68 | | -### Resolution |
| 55 | +## The account is not authorized to login from this station |
69 | 56 |
|
70 | | -This problem is related to mismatched SMB Signing settings between the client computer and the DC that is being contacted for the domain join operation. Review the following documentation to further investigate the current and recommended values in your environment: |
71 | | -[281648 Error message: The account is not authorized to login from this station](account-not-authorized-login-from-this-station.md) |
72 | | -[823659 Client, service, and program issues can occur if you change security settings and user rights assignments](https://support.microsoft.com/help/823659/client-service-and-program-issues-can-occur-if-you-change-security-set) |
| 57 | +This problem is related to mismatched Server Message Block (SMB) signing settings between the client computer and the DC that is being contacted for the domain join operation. To further investigate the current and recommended values in your environment, see: |
73 | 58 |
|
74 | | -## The account specified for this service is different from the account specified for other services running in the same process. |
| 59 | +- [Error message: The account isn't authorized to login from this station](account-not-authorized-login-from-this-station.md) |
| 60 | +- [Client, service, and program issues can occur if you change security settings and user rights assignments](https://support.microsoft.com/help/823659/client-service-and-program-issues-can-occur-if-you-change-security-set) |
75 | 61 |
|
76 | | -### Resolution |
| 62 | +## The account specified for this service is different from the account specified for other services running in the same process |
77 | 63 |
|
78 | | -Make sure that the DC through which you are trying to join the domain has the Windows Time service started. |
| 64 | +Make sure that the DC through which you're trying to join the domain has the Windows Time service started. |
0 commit comments