Merge pull request #8739 from v-lianna/CI_5387

AB#5387 status-code-0x216d-not-joined-domain.md

Author: Simonx Xu

support/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance.md

@@ -250,39 +250,7 @@ It indicates that the LDAP Port TCP 389 is open between the client and the DC.
 
 ### Error code 0x216d
 
-The following error occurred when attempting to join the domain:
-
-> Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.
-
-:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/error-0x216d-message.png" alt-text="Screenshot of the dialog box showing the error message for error code 0x216d.":::
-
-```output
-mm/dd/yyyy hh:mm:ss:ms NetpMapGetLdapExtendedError: Parsed [0x216d] from server extended error string: 0000216D: SvcErr: DSID-031A124C, problem 5003 (WILL_NOT_PERFORM), data 0
-mm/dd/yyyy hh:mm:ss:ms NetpModifyComputerObjectInDs: ldap_add_s failed: 0x35 0x216d
-mm/dd/yyyy hh:mm:ss:ms NetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x216d
-mm/dd/yyyy hh:mm:ss:ms NetpProvisionComputerAccount: LDAP creation failed: 0x216d
-mm/dd/yyyy hh:mm:ss:ms NetpProvisionComputerAccount: Retrying downlevel per options
-mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: NetUserAdd on '<dc_fqdn>' for 'CLIENT1$' failed: 0x216d
-mm/dd/yyyy hh:mm:ss:ms NetpProvisionComputerAccount: retry status of creating account: 0x216d
-mm/dd/yyyy hh:mm:ss:ms ldap_unbind status: 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpJoinCreatePackagePart: status:0x216d.
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: Function exits with status of: 0x216d
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: status of disconnecting from '\\<dc_fqdn>': 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on '<domain_name>' returned 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: NetpResetIDNEncoding on '<domain_name>': 0x0
-mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x216d
-```
-
-Error 0x216d is logged in one of these conditions:
-
-- The user account trying to join the machine to the domain has exceeded the limit of 10 machines joined to the domain.
-- There is a GPO restriction to block authenticated users from joining a machine to the domain.
-
-Verify that the user account is a member of the group mentioned in the **Add Workstations to domain** policy of the **Default Domain Controller Policy** GPO or the **Winning** GPO.
-
-The GPO setting is located at **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies User Rights Assignment** > **Add workstations to domain**.
-
-To verify the default limit to the number of workstations a user can join to the domain, see [Default limit to number of workstations a user can join to the domain](default-workstation-numbers-join-domain.md).
+For more information, see [Status code 0x216d: Your computer could not be joined to the domain](status-code-0x216d-not-joined-domain.md).
 
 ### Other errors that occur when you join Windows-based computers to a domain
 

support/windows-server/active-directory/status-code-0x216d-not-joined-domain.md

@@ -0,0 +1,52 @@
+---
+title: Status Code 0x216d and Your Computer Can't Be Joined to the Domain
+description: Helps resolve an issue in which you can't join a domain with status code 0x216d.
+ms.date: 04/23/2025
+manager: dcscontentpm
+audience: itpro
+ms.topic: troubleshooting
+ms.reviewer: kaushika, raviks, herbertm, dennhu, eriw, v-lianna
+ms.custom:
+- sap:active directory\on-premises active directory domain join
+- pcy:WinComm Directory Services
+---
+# Status code 0x216d: Your computer could not be joined to the domain
+
+This article helps resolve an issue in which you can't join a workgroup computer to a domain with status code 0x216d.
+
+When you join a workgroup computer to a domain, you receive the following error message:
+
+> The following error occurred when attempting to join the domain "\<DomainName\>":
+>
+> Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.
+
+When you check the **NetSetup.log** file, you see the following entries:
+
+```output
+NetpMapGetLdapExtendedError: Parsed [0x216d] from server extended error string: 0000216D: SvcErr: DSID-031A124C, problem 5003 (WILL_NOT_PERFORM), data 0
+NetpModifyComputerObjectInDs: ldap_add_s failed: 0x35 0x216d
+NetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x216d
+NetpProvisionComputerAccount: LDAP creation failed: 0x216d
+NetpProvisionComputerAccount: Retrying downlevel per options
+NetpManageMachineAccountWithSid: NetUserAdd on '<dc_fqdn>' for 'CLIENT1$' failed: 0x216d
+NetpProvisionComputerAccount: retry status of creating account: 0x216d
+ldap_unbind status: 0x0
+NetpJoinCreatePackagePart: status:0x216d.
+NetpJoinDomainOnDs: Function exits with status of: 0x216d
+NetpJoinDomainOnDs: status of disconnecting from '\\<dc_fqdn>': 0x0
+NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on '<domain_name>' returned 0x0
+NetpJoinDomainOnDs: NetpResetIDNEncoding on '<domain_name>': 0x0
+NetpDoDomainJoin: status: 0x216d
+```
+
+Status code 0x216d is logged in one of the following conditions:
+
+- The user account trying to join the computer to the domain has exceeded the limit of 10 computers that can be joined to the domain.
+- There's a Group Policy Object (GPO) restriction to block authenticated users from joining a computer to the domain.
+
+To resolve the issue, verify the following items:
+
+- The [default limit on the number of workstations a user can join to the domain](default-workstation-numbers-join-domain.md).
+- The user account is a member of the group mentioned in the **Add workstations to domain** policy of the **Default Domain Controllers Policy** GPO or the **Winning GPO**.
+
+    The GPO setting is located at **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **User Rights Assignment** > **Add workstations to domain**.

support/windows-server/toc.yml

@@ -361,6 +361,8 @@ items:
       href: ./active-directory/error-0xa8b-resolve-dns-fail.md
     - name: Netlogon service doesn't keep settings after in-place upgrade
       href: ./active-directory/netlogon-service-not-start-automatically.md
+    - name: Status code 0x216d
+      href: ./active-directory/status-code-0x216d-not-joined-domain.md
     - name: Status code 0x32 and you can't join a domain
       href: ./active-directory/status-code-0x32-cannot-join-domain.md
     - name: Support boundaries for Active Directory over NAT