Skip to content

Commit 5bd9adf

Browse files
authored
Updates from editor
1 parent f2176d5 commit 5bd9adf

1 file changed

Lines changed: 11 additions & 11 deletions

File tree

support/windows-server/active-directory/failure-when-you-use-an-existing-computer-account-to-join-a-domain.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: Failure when you use an existing computer account to join a domain
2+
title: Failure When You Use an Existing Computer Account to Join a Domain
33
description: Addresses the issue of failing to join a computer to a domain when an existing computer account with the same name already exists.
4-
ms.date: 03/26/2025
4+
ms.date: 03/27/2025
55
manager: dcscontentpm
66
audience: itpro
77
ms.topic: troubleshooting
@@ -14,9 +14,9 @@ ms.custom:
1414

1515
This article addresses the issue of failing to join a computer to a domain when an existing computer account with the same name already exists.
1616

17-
## Symptom
17+
## Symptoms
1818

19-
When you try to use an existing computer account name to join a computer to a domain, the operation fails. And you receive the following error messages:
19+
When you try to use an existing computer account name to join a computer to a domain, the operation fails and you receive the following error messages:
2020

2121
In the **Access work or school** page:
2222
> Can't join this domain. Contact your IT admin for more info.
@@ -29,7 +29,7 @@ In **System Properties**:
2929
3030
### Netsetup.log
3131

32-
Review the following example of the Netsetup.log on a fully updated system.
32+
Review the following example of the **Netsetup.log** on a fully updated system.
3333

3434
```output
3535
NetpProvisionComputerAccount:
@@ -84,28 +84,28 @@ NetpDoDomainJoin: status: 0xaac
8484

8585
### Error detail
8686

87-
|HEX|DEC|Symbolic Name|Error Description|Header|
87+
|HEX|DEC|Symbolic name|Error description|Header|
8888
|---|---|---|---|---|
8989
|0x8b0|2224|NERR_UserExists|The account already exists.|lmerr.h|
9090
|0xaac|2732|NERR_AccountReuseBlockedByPolicy|An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.|lmerr.h|
9191

9292
## Cause
9393

94-
Windows introduced extra protections with updates released on and after October 11, 2022. These protections intentionally prevent domain join operations from reusing an existing computer account in the target domain unless the following specific conditions are met:
94+
Windows introduced additional protections with updates released on and after October 11, 2022. These protections intentionally prevent domain join operations from reusing an existing computer account in the target domain unless the following specific conditions are met:
9595

9696
- The user attempting the operation is the creator of the existing account.
97-
- The computer was created by a member of domain administrators, enterprise administrators, or built-in administrators groups.
98-
- The owner of the computer account object that is being reused is a member of the "Domain controller: Allow computer account reuse during domain join" Group Policy setting. This setting requires the installation of Windows updates released on or after March 14, 2023, on all member computers and domain controllers.
97+
- The computer is created by a member of domain administrators, enterprise administrators, or built-in administrators groups.
98+
- The owner of the computer account object that is being reused is a member of the **Domain controller: Allow computer account reuse during domain join** Group Policy setting. This setting requires the installation of Windows updates released on or after March 14, 2023, on all member computers and domain controllers.
9999

100100
## Resolution
101101

102102
To fix the issue, follow these steps:
103103

104104
1. Perform the join operation by using the same account that created the computer account in the target domain.
105105
2. If the existing account is stale (unused), delete it before attempting to join the domain again.
106-
3. Rename the computer and join using a different account that doesn't already exist.
106+
3. Rename the computer and join the domain using a different account that doesn't exist.
107107
4. If a trusted security principal owns the existing account, and an administrator wants to reuse the account, use the **Domain controller: Allow computer account re-use during domain join** Group Policy.
108108

109109
## Reference
110110

111-
For more information about domain join hardening changes, see [KB5020276—Netjoin: Domain join hardening changes](https://support.microsoft.com/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8)
111+
For more information about domain join hardening changes, see [KB5020276—Netjoin: Domain join hardening changes](https://support.microsoft.com/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8).

0 commit comments

Comments
 (0)