Merge pull request #8740 from v-lianna/CI_5388

AB#5388 status-code-0x3a-server-not-perform-operation.md

Author: Simonx Xu

support/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance.md

@@ -218,35 +218,7 @@ When you enter the domain name, make sure you enter the DNS Domain Name rather t
 
 ### Error code 0x3a
 
-The following error occurred when attempting to join the domain:
-
-> The specified server cannot perform the requested operation.
-
-:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/error-0x3a-message.png" alt-text="Screenshot of the dialog box showing the error message for error code 0x3a.":::
-
-Here's an example from the *netsetup.log* file:
-
-```output
-mm/dd/yyyy hh:mm:ss:ms NetpLdapBind: ldap_bind failed on <dc_fqdn>: 81: Server Down
-mm/dd/yyyy hh:mm:ss:ms NetpJoinCreatePackagePart: status:0x3a.
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: Function exits with status of: 0x3a
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: status of disconnecting from '\\<dc_fqdn>': 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on '<domain_name>' returned 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: NetpResetIDNEncoding on '<domain_name>': 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x3a
-```
-
-Error 0x3a is logged when the client computer lacks network connectivity on TCP port 389 between the client computer and the DC. To troubleshoot this issue, use the following command to test the connection:
-
-```PowerShell
-Test-NetConnection <IP_address_of_the_DC> -Port 389
-```
-
-Expected Output:
-
-:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/test-netconnection-output-389.png" alt-text="Screenshot that shows the Test-NetConnection command for TCP port 389 output.":::
-
-It indicates that the LDAP Port TCP 389 is open between the client and the DC.
+For more information, see [Status code 0x3a: The specified server cannot perform the requested operation](status-code-0x3a-server-not-perform-operation.md).
 
 ### Error code 0x216d
 

support/windows-server/active-directory/status-code-0x3a-server-not-perform-operation.md

@@ -0,0 +1,70 @@
+---
+title: Status Code 0x3a
+description: Provides troubleshooting steps for resolving the status code 0x3a when you join a workgroup computer to a domain.
+ms.date: 04/23/2025
+manager: dcscontentpm
+audience: itpro
+ms.topic: troubleshooting
+ms.reviewer: kaushika, raviks, herbertm, dennhu, eriw, v-lianna
+ms.custom:
+- sap:active directory\on-premises active directory domain join
+- pcy:WinComm Directory Services
+---
+# Status code 0x3a: The specified server cannot perform the requested operation
+
+This article provides troubleshooting steps for resolving the status code 0x3a when you join a workgroup computer to a domain.
+
+When you join a workgroup computer to a domain, you receive the following error message:
+
+> The following error occurred when attempting to join the domain"\<DomainName\>":
+>
+> The specified server cannot perform the requested operation.
+
+When you check the **NetSetup.log** file, you see the following entries. For example:
+
+```output
+NetpLdapBind: ldap_bind failed on <dc_fqdn>: 81: Server Down
+NetpJoinCreatePackagePart: status:0x3a.
+NetpJoinDomainOnDs: Function exits with status of: 0x3a
+NetpJoinDomainOnDs: status of disconnecting from '\\<dc_fqdn>': 0x0
+NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on '<domain_name>' returned 0x0
+NetpJoinDomainOnDs: NetpResetIDNEncoding on '<domain_name>': 0x0
+NetpDoDomainJoin: status: 0x3a
+```
+
+## The client computer lacks network connectivity on TCP 389 port
+
+Status code 0x3a is logged when the client computer lacks reliable network connectivity on Transmission Control Protocol (TCP) 389 port between the client computer and the domain controller (DC).
+
+In addition to the port being blocked on a firewall, incorrect maximum transmission unit (MTU) sizes on some network devices can lead to packet loss during the domain join process and cause the domain join to fail.
+
+## Test and verify the connection
+
+To troubleshoot this issue, use the following steps:
+
+1. Run the following cmdlet to test the connection:
+
+    ```powershell
+    Test-NetConnection <IP_address_of_the_DC> -Port 389
+    ```
+
+    The expected output is shown as follows:
+
+    ```output
+    ComputerName            : <ComputerName>
+    RemoteAddress           : <RemoteAddress>
+    RemotePort              : 389
+    InterfaceAlias          : Ethernet 2
+    SourceAddress           : <SourceAddress>
+    TcpTestSucceeded        : True
+    ```
+
+    The output indicates that the Lightweight Directory Access Protocol (LDAP) port TCP 389 is open between the client and the DC.
+
+2. Collect the network trace to verify the TCP 389 connection to the DC. For example, on the client machine, you might see TCP retransmissions that indicate no response is received from the DC's TCP 389 port.
+
+    ```output
+    CLIENT 	DC	TCP	TCP:Flags=CE....S., SrcPort=49300, DstPort=LDAP(389), PayloadLen=0, Seq=3537217409, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192 {TCP:58, IPv4:4}
+    CLIENT 	DC	TCP	TCP:[SynReTransmit #177]Flags=CE....S., SrcPort=49300, DstPort=LDAP(389), PayloadLen=0, Seq=3537217409, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192	{TCP:58, IPv4:4}
+    CLIENT 	DC	TCP	TCP:[SynReTransmit #177]Flags=......S., SrcPort=49300, DstPort=LDAP(389), PayloadLen=0, Seq=3537217409, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192	{TCP:58, IPv4:4}
+    ```

support/windows-server/toc.yml

@@ -365,6 +365,8 @@ items:
       href: ./active-directory/status-code-0x216d-not-joined-domain.md
     - name: Status code 0x32 and you can't join a domain
       href: ./active-directory/status-code-0x32-cannot-join-domain.md
+    - name: Status code 0x3a
+      href: ./active-directory/status-code-0x3a-server-not-perform-operation.md
     - name: Support boundaries for Active Directory over NAT
       href: ./active-directory/support-for-active-directory-over-nat.md
     - name: '"The account is not authorized to login from this station" error'