Skip to content

Commit 4e8fc8c

Browse files
Deland-HanDeland-Han
authored
Merge pull request #8880 from v-lianna/CI_5708
AB#5708 Split article into two separate articles
2 parents 6b02ace + 899eff6 commit 4e8fc8c

5 files changed

Lines changed: 207 additions & 252 deletions

File tree

‎.openpublishing.redirection.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13684,6 +13684,10 @@
1368413684
"source_path": "support/windows-server/active-directory/dcs-cannot-be-located-high-rate-outbound-sessions.md",
1368513685
"redirect_url": "/troubleshoot/windows-server/user-profiles-and-logon/dcs-cannot-be-located-high-rate-outbound-sessions"
1368613686
},
13687+
{
13688+
"source_path": "support/windows-server/active-directory/troubleshoot-errors-join-computer-to-domain.md",
13689+
"redirect_url": "/troubleshoot/windows-server/active-directory/networking-errors-join-computer-domain"
13690+
},
1368713691
{
1368813692
"source_path": "support/power-platform/power-automate/desktop-flows/troubleshoot-excel-errors.md",
1368913693
"redirect_url": "/troubleshoot/power-platform/power-automate/desktop-flows/office-automation/excel/troubleshoot-excel-errors"

‎support/windows-server/active-directory/domain-join-authentication-errors.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: Troubleshoot Authentication Errors When Joining Windows-based Computers to a Domain
3+
description: Troubleshooting guide for authentication related error messages that occurs when you join Windows-based computers to a domain.
4+
ms.date: 05/09/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, v-lianna
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Troubleshoot authentication errors that occur when you join Windows-based computers to a domain
14+
15+
This article describes several authentication related error messages that can occur when you join client computers that are running Windows to a domain. This article also provides troubleshooting suggestions for these errors. For networking related error messages, see [Troubleshoot networking errors that occur when you join Windows-based computers to a domain](domain-join-networking-errors.md).
16+
17+
_Original KB number:_   4341920
18+
19+
## Where to find the NetSetup.log file
20+
21+
The **NetSetup.log** file contains most information about domain join activities. The file is located on the client machine at **%windir%\\debug\\NetSetup.log**. This log file is enabled by default. No need to explicitly enable it.
22+
23+
## You have exceeded the maximum number of computer accounts you are allowed to create in this domain
24+
25+
Make sure that you have permissions to add computers to the domain, and that you don't exceed the quota that is defined by your domain administrator.
26+
27+
To join a computer to the domain, the user account must be granted **Create computer object** permissions in Active Directory.
28+
29+
> [!NOTE]
30+
> By default, a nonadministrator user can join a maximum of 10 computers to an Active Directory domain.
31+
32+
## Logon failure: The target account name is incorrect
33+
34+
Check that the domain controllers (DCs) are registered by using correct IP addresses on the Domain Name System (DNS) server, and that their Service Principal Names (SPNs) are registered correctly in their Active Directory accounts.
35+
36+
## Logon failure: the user has not been granted the requested logon type at this computer
37+
38+
Make sure that you have permissions to add computers to the domain. To join a computer to the domain, the user account must be granted the **Create computer object** permission in Active Directory.
39+
40+
Additionally, make sure that the specified user account is allowed to log on locally to the client computer. To do this, configure the **Allow log on locally** setting in Group Policy under **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **User Rights Assignment**.
41+
42+
## Logon failure: unknown user name or bad password
43+
44+
Make sure that you use the correct user name and password combination of an existing Active Directory user account when you're prompted for credentials to add the computer to the domain.
45+
46+
## No mapping between account names and security IDs was done
47+
48+
This error is likely a transient error that is logged when a domain join searches the target domain to determine whether a matching computer account was already created or whether the join operation has to dynamically create a computer account on the target domain.
49+
50+
## Not enough storage is available to complete this operation
51+
52+
This error can occur when the Kerberos token size is larger than the maximum default size. If this situation, you have to increase the Kerberos token size of the computer that you try to join to the domain. For more information, see:
53+
54+
- ["Not enough storage is available to complete this operation" error message when you use a domain controller to join a computer to a domain](../../windows-client/windows-security/not-enough-storage-available-complete-operation-error.md)
55+
- [Problems with Kerberos authentication when a user belongs to many groups](../windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md)
56+
57+
## The account is not authorized to login from this station
58+
59+
This problem is related to mismatched Server Message Block (SMB) signing settings between the client computer and the DC that is being contacted for the domain join operation. To further investigate the current and recommended values in your environment, see:
60+
61+
- [Error message: The account isn't authorized to login from this station](account-not-authorized-login-from-this-station.md)
62+
- [Client, service, and program issues can occur if you change security settings and user rights assignments](https://support.microsoft.com/help/823659/client-service-and-program-issues-can-occur-if-you-change-security-set)
63+
64+
## The account specified for this service is different from the account specified for other services running in the same process
65+
66+
Make sure that the DC through which you're trying to join the domain has the Windows Time service started.

‎support/windows-server/active-directory/domain-join-networking-errors.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
title: Troubleshoot Networking Errors When Joining Windows-based Computers to a Domain
3+
description: Troubleshooting guide for networking related error messages that occur when you join Windows-based computers to a domain.
4+
ms.date: 05/09/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, v-lianna
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Troubleshoot networking errors that occur when you join Windows-based computers to a domain
14+
15+
This article describes several networking related error messages that occur when you join client computers that are running Windows to a domain. This article also provides troubleshooting suggestions for these errors. For authentication related error messages, see [Troubleshoot authentication errors that occur when you join Windows-based computers to a domain](domain-join-authentication-errors.md).
16+
17+
_Original KB number:_   4341920
18+
19+
## Where to find the NetSetup.log file
20+
21+
The **NetSetup.log** file contains most information about domain join activities. The file is located on the client machine at **%windir%\\debug\\NetSetup.log**. This log file is enabled by default. No need to explicitly enable it.
22+
23+
## An attempt to resolve the DNS name of a DC in the domain being joined has failed. Please verify this client is configured to reach a DNS server that can resolve DNS names in the target domain
24+
25+
When you type the domain name, make sure that you type the Domain Name System (DNS) name and not the network basic input/output System (NetBIOS) name. For example, if the DNS name of the target domain is `contoso.com`, make sure that you enter `contoso.com` instead of the NetBIOS domain name of "contoso."
26+
27+
Additionally, verify that the computer can reach a DNS server that hosts the DNS zone of the target domain or can resolve DNS names in that domain. Make sure that the correct DNS server is configured on this client as the preferred DNS, and that the client has connectivity to that server. To verify this, you can run one of the following commands:
28+
29+
```console
30+
nltest /dsgetdc:<netbios domain name> /force
31+
```
32+
33+
```console
34+
nltest /dsgetdc:<DNS domain name> /force
35+
```
36+
37+
## An attempt to resolve the DNS name of a domain controller in the domain being joined has failed. Please verify this client is configured to reach a DNS server that can resolve DNS names in the target Domain
38+
39+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name.
40+
41+
Additionally, verify that the computer can reach a DNS server that hosts the DNS zone of the target domain or can resolve DNS names in that domain. Make sure that the correct DNS server is configured on this client as the preferred DNS, and that the client has connectivity to that server. To verify this, you can run one of the following commands:
42+
43+
```console
44+
nltest /dsgetdc:<netbios domain name> /force
45+
```
46+
47+
```console
48+
nltest /dsgetdc:<DNS domain name> /force
49+
```
50+
51+
## An operation was attempted on a nonexistent network connection
52+
53+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name.
54+
55+
Additionally, restart the computer before you try to join the computer to the domain.
56+
57+
## Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again
58+
59+
Restart the computer that you're trying to join to the domain to make sure that there are no latent connections to any of the domain servers.
60+
61+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name.
62+
63+
## Network name cannot be found
64+
65+
Verify that the computer can reach a DNS server that hosts the DNS zone of the target domain or can resolve DNS names in that domain. Make sure that the correct DNS server has been configured on this client as the preferred DNS, and that the client has connectivity to that server. To verify this, you can run one of the following commands:
66+
67+
```console
68+
nltest /dsgetdc:<netbios domain name> /force
69+
```
70+
71+
```console
72+
nltest /dsgetdc:<DNS domain name> /force
73+
```
74+
75+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name.
76+
77+
Additionally, you can update the network adapter driver.
78+
79+
## No more connections can be made to this remote computer at this time because there are already as many connections as the computer can accept
80+
81+
Before joining the computer to the domain, make sure that you have cleared all mapped connections to any drives.
82+
83+
Restart the computer that you're trying to join to the domain to make sure that there are no latent connections to any of the domain servers.
84+
85+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name.
86+
87+
The error might be transient. Try again later. If the issue persists, verify the status of the domain controller (DC) that the client is connecting to (active connections, network connectivity, and so on). You might want to restart the DC if the issue persists.
88+
89+
## The format of the specified network name is invalid
90+
91+
Verify that the computer can reach a DNS server that hosts the DNS zone of the target domain or can resolve DNS names in that domain. Make sure that the correct DNS server has been configured on this client as the preferred DNS, and that the client has connectivity to that server. To verify this, you can run one of the following commands:
92+
93+
```console
94+
nltest /dsgetdc:<netbios domain name> /force
95+
```
96+
97+
```console
98+
nltest /dsgetdc:<DNS domain name> /force
99+
```
100+
101+
When you type the domain name, make sure that you type the DNS name and not the NetBIOS name. Make sure that you have the most up-to-date drivers installed for the client computer's network adapter. Verify connectivity between the client that is being joined and the target DC over the required ports and protocols. Disable the TCP Chimney Offload feature and IP offloading.
102+
103+
## The directory service has exhausted the pool of relative identifiers
104+
105+
Make sure that the DC that hosts the relative ID (RID) operations master is online and functional. For more information, see [Event ID 16650: The account-identifier allocator failed to initialize in Windows Server](event-16650-account-identifier-allocator-not-initialize.md).
106+
107+
> [!Note]
108+
> You can use the `netdom query fsmo` command to determine which DC has the RID Master role.
109+
110+
Verify that Active Directory is replicating between all DCs. You can use the following command to detect any errors:
111+
112+
```console
113+
repadmin /replsummary /bysrc /bydest /sort:delta
114+
```
115+
116+
## The remote procedure call failed and did not execute
117+
118+
Make sure that you have the most up-to-date drivers installed for the client computer's network adapter. Verify connectivity between the client that is being joined and the target DC over the required ports and protocols. Disable the TCP Chimney Offload feature and IP offloading.
119+
120+
This problem can also be caused by one of the following conditions:
121+
122+
- A network device (router, firewall, or VPN device) is blocking connectivity over the ports and protocols that are used by the MSRPC protocol.
123+
- A network device (router, firewall, or VPN device) is rejecting network packets between the client that is being joined and the DC.
124+
125+
> [!NOTE]
126+
> The following articles contain port requirement information:
127+
>
128+
> - [Service overview and network port requirements for Windows](../networking/service-overview-and-network-port-requirements.md)
129+
> - [How to configure a firewall for domains and trusts](config-firewall-for-ad-domains-and-trusts.md)
130+
131+
## Changing the Primary Domain DNS name of this computer to "" failed. The name will remain ".". The specified server cannot perform the operation
132+
133+
This error occurs when you use the domain join UI to join a Windows 7 or Windows Server 2008 R2 workgroup computer to an Active Directory domain by specifying the target DNS domain. To fix this error, see [Windows 7 or Windows Server 2008 R2 domain join displays error "Changing the Primary Domain DNS name of this computer to "" failed...."](https://support.microsoft.com/help/2018583/windows-7-or-windows-server-2008-r2-domain-join-displays-error-changin).

0 commit comments

Comments
 (0)