A failed domain join shows one short message in the dialog, but the real story is in NetSetup.log: the step that failed and a hex status code. This quick reference lists the codes and messages Microsoft documents for joins (DNS and DC locator, network and RPC, accounts, rights and quotas), with the usual cause and the first check for each, plus the tests that prove the join is healthy afterward.
Codes in this quick reference
0xaac: An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.Join dialog / NetSetup.logCan't join this domain. Contact your IT admin for more info.Settings > Accounts > Access work or school0x8b0 NERR_UserExists: The account already exists.NetSetup.log0x216d: You have exceeded the maximum number of computer accounts you are allowed to create in this domain.Join dialog / NetSetup.log0x569: Logon failure: the user has not been granted the requested logon type at this computerJoin dialog / NetSetup.log0x52e: Logon failure: unknown user name or bad passwordJoin dialog / NetSetup.log0x574: Logon failure: The target account name is incorrectJoin dialog / NetSetup.log0x534: No mapping between account names and security IDs was doneNetSetup.log
+ 20 more codes in the tables below.
How to read these codes#
- The dialog: System Properties shows
The following error occurred attempting to join the domain "contoso.com":followed by the message. Settings › Accounts › Access work or school may only sayCan't join this domain. Contact your IT admin for more info., so always open the log. - The log:
%windir%\debug\NetSetup.logon the client, written by default. Read from the bottom:NetpDoDomainJoin: status: 0x0means success; any other value is the failure. Decode a value withcertutil -error 0x54bornet helpmsg 1355(the decimal value). - Read up from the status line to the first line that mentions the same code. That line names the step: DC discovery, the LDAP or SAM call that creates the computer account, or the SMB session to the DC.
Text
NetpManageMachineAccountWithSid: The computer account already exists in Active Directory.Re-using the account was blocked by security policy.
NetpProvisionComputerAccount: retry status of creating account: 0xaac
NetpJoinDomainOnDs: Function exits with status of: 0xaac
NetpDoDomainJoin: status: 0xaacA join needs DNS (TCP/UDP 53), Kerberos (TCP 88), the RPC endpoint mapper (TCP 135), LDAP and the DC locator (TCP/UDP 389), SMB (TCP 445) and dynamic RPC (TCP 1024-65535) from the client to the DC. Start every investigation with these:
PowerShell
# Last status lines of the failed attempt
Select-String -Path "$env:windir\debug\NetSetup.log" -Pattern 'NetpDoDomainJoin: status|Function exits with status|failed' |
Select-Object -Last 15
# Can this client find a DC? Use the DNS name of the domain, not the NetBIOS name
nltest /dsgetdc:contoso.com /force
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.contoso.com
# TCP reachability of the DC that answered
foreach ($p in 53, 88, 135, 389, 445) { '{0,-4} {1}' -f $p, (Test-NetConnection dc01.contoso.com -Port $p -InformationLevel Quiet) }Joins during a task sequence, Autopilot hybrid join or Cloud PC provisioning run into many of the same causes; see the task sequence error codes, the Autopilot hybrid join article and Cloud PC provisioning failures for their extra steps.
DNS and DC locator errors#
| Code / message | Meaning | Usual cause | First check |
|---|---|---|---|
0xa8b: An attempt to resolve the DNS name of a DC in the domain being joined has failed. Please verify this client is configured to reach a DNS server that can resolve DNS names in the target domain | The client can't find a DC through DNS. | A workgroup machine using a DNS server that doesn't host or forward the AD zone, or the NetBIOS name typed instead of the DNS name. | Point the preferred DNS at AD DNS; join with contoso.com; run nltest /dsgetdc. |
0x0000232B RCODE_NAME_ERROR: DNS name does not exist. | The DNS server answered, but the DC locator SRV record isn't there. | Wrong DNS server, or missing records under _msdcs. | Query the SRV record; on DCs, restarting Netlogon re-registers missing SRV records. |
0x0000232A | The DNS name can't be resolved. | The DNS server couldn't answer for the domain. | Query the same record against each configured DNS server with Resolve-DnsName -Server. |
0x54b: The specified domain either does not exist or could not be contacted. | DC discovery failed. | DNS problems, or blocked UDP/TCP 389 or 53. | nltest /dsgetdc:contoso.com /force and the port test above. |
0x3a: The specified server cannot perform the requested operation | The LDAP part of the join fails. | No reliable TCP 389 connectivity between the client and the DC. | Test-NetConnection on 389; firewall and IPS logs. |
The classic dialog for a DNS failure is An Active Directory Domain Controller (AD DC) for the domain "contoso.com" could not be contacted. Its Details show the record and the code:
Text
The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "contoso.com":
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.contoso.comNetwork, SMB and RPC errors#
| Code / message | Meaning | Usual cause | First check |
|---|---|---|---|
0x6bf or 0xc002001c: The remote procedure call failed and did not execute | An RPC call to the DC was cut off. | A router, firewall or VPN device rejects packets between the client and the DC. | TCP 135 and the dynamic RPC range; current NIC driver; turn off TCP Chimney Offload and IP offloading to test. |
0x6d9: There are no more endpoints available from the endpoint mapper | The RPC endpoint can't be reached. | Connectivity between the client and the DC is blocked. | TCP 135 plus TCP 1024-65535 to the DC. |
0x40 (ERROR_NETNAME_DELETED): The specified network name is no longer available. | The SMB session to the DC dropped; the log shows NetUseAdd to \\dc1.adatum.com\IPC$ returned 64. | The Kerberos reply for the SMB session never arrives: a WAN accelerator acknowledges the request, or a firewall drops the KDC reply. | Reproduce with net use to the same \\dc\IPC$ path under a network trace; replies with an IP TTL of 64 or lower hint at a Linux-based accelerator. |
Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. | A session to the DC already exists under other credentials. | Mapped drives or latent connections. | Restart, then join with the DNS domain name. |
An operation was attempted on a nonexistent network connection | A stale connection. | NetBIOS name used, or leftover sessions. | Restart and use the DNS name. |
Network name cannot be found | The name can't be found on the network. | DNS that doesn't serve the AD zone; old NIC driver. | nltest /dsgetdc; update the NIC driver. |
No more connections can be made to this remote computer at this time because there are already as many connections as the computer can accept | The DC refused another session. | Mapped connections on the client, or a busy DC; can be transient. | Clear mapped drives, restart, retry; then check the DC. |
The format of the specified network name is invalid | Name or network-stack problem. | DNS, outdated NIC drivers or blocked ports. | DNS and ports as above; turn off TCP Chimney Offload and IP offloading to test. |
Account, rights and quota errors#
| Code / message | Meaning | Usual cause | First check |
|---|---|---|---|
0xaac (NERR_AccountReuseBlockedByPolicy): An account with the same name exists in Active Directory. Re-using the account was blocked by security policy. | Reuse of an existing computer object was refused. | Join hardening in updates from October 11, 2022 (CVE-2022-38042). Reuse is allowed only if the joining user created the object, a member of Domain Admins, Enterprise Admins or built-in Administrators created it, or its owner is trusted in Domain controller: Allow computer account reuse during domain join (needs updates from March 14, 2023 on members and DCs). | Who owns and created the object (command below). Join as that account, trust the owner in the policy, or delete the stale object and join again. |
0x8b0 (NERR_UserExists): The account already exists. | A computer object with that name exists. | Same situation as 0xaac. | Same checks as 0xaac. |
0x216d: Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased. | The DC refused to create another computer object for this user; the log shows NetpProvisionComputerAccount: LDAP creation failed: 0x216d. | A non-admin passed the default limit of 10 joins, or a GPO restricts Add workstations to domain. | The quota (command below) and User Rights Assignment › Add workstations to domain in the Default Domain Controllers Policy. Better: pre-create objects or delegate Create Computer objects on the OU to a join account. |
0x569: Logon failure: the user has not been granted the requested logon type at this computer | A user right is missing. | The join account lacks Access this computer from the network on the DC handling the join. | User rights in the GPO applied to DCs (gpresult /h on the DC). |
0x52e: Logon failure: unknown user name or bad password | Wrong credentials. | A typo, a wrong password, or an account that doesn't exist. | Enter the account as CONTOSO\user or a UPN. |
0x574: Logon failure: The target account name is incorrect | The Kerberos target name doesn't match the DC that answered. | DC DNS records with wrong IP addresses, or bad SPN registrations. | The DC's A records; duplicate SPNs with setspn -X. |
0x534: No mapping between account names and security IDs was done | A name lookup returned nothing. | Usually transient: logged while the join checks whether the computer object exists. | Only a problem if it's the final status; read further down the log. |
0x5: Access is denied. | The join account can't write the object. | No create rights on the target OU, or no rights on a pre-created object. | Delegation on the OU; the pre-created object's owner. |
0x576: There is a time and/or date difference between the client and server. | Kerberos rejects the clock difference. | The client's clock is far from the DC's. | w32tm /stripchart /computer:dc01.contoso.com /samples:3 /dataonly. |
Not enough storage is available to complete this operation | The Kerberos token is too big. | The join account is in many groups. | Raise the Kerberos maximum token size on the client, or use a join account with fewer groups. |
The account is not authorized to login from this station | SMB session setup refused. | SMB signing settings differ between the client and the DC. | Compare the SMB signing policies on both sides. |
The account specified for this service is different from the account specified for other services running in the same process | A service problem on the DC side. | The Windows Time service isn't running on the DC used for the join. | Start W32Time on that DC. |
The directory service has exhausted the pool of relative identifiers | The DC can't issue a SID for the new object. | The RID master is offline or replication is broken. | netdom query fsmo; repadmin /replsummary /bysrc /bydest /sort:delta. |
PowerShell
# 0xaac / 0x8b0: who owns and who created the existing object
$pc = Get-ADComputer PC01 -Properties nTSecurityDescriptor, 'mS-DS-CreatorSID', whenCreated
$pc.nTSecurityDescriptor.Owner
$pc.'mS-DS-CreatorSID' # filled in when a non-admin created it through the join quota
# 0x216d: the domain's machine account quota (10 by default)
Get-ADObject (Get-ADDomain).DistinguishedName -Properties 'ms-DS-MachineAccountQuota' |
Select-Object 'ms-DS-MachineAccountQuota'
# Join from Windows PowerShell 5.1 with an explicit OU
Add-Computer -DomainName contoso.com -OUPath 'OU=Workstations,DC=contoso,DC=com' -Credential (Get-Credential CONTOSO\svc-join) -RestartWatch out: Don't delete an existing computer object just to get past 0xaac until you've confirmed it's stale. Deleting the object of a working machine breaks that machine's trust with the domain.
How to verify a fix#
- The last lines of
NetSetup.logshowNetpJoinDomainOnDs: Function exits with status of: 0x0andNetpDoDomainJoin: status: 0x0. - After the restart,
Test-ComputerSecureChannelreturnsTrueandnltest /sc_verify:contoso.comreportsNERR_Successfor both the connection and the trust verification. Get-ADComputer PC01 -Properties whenCreatedshows the object in the intended OU, andgpresult /rlists computer policies from the domain.- For hybrid-joined devices, continue with dsregcmd /status. If DC discovery keeps failing, the DC-side events are in the AD DS, Netlogon and DNS events reference, and replication problems behind RID errors in the replication errors reference.
Tip: For a log bundle Microsoft support can read, Microsoft's Auth Scripts (start-auth.ps1, reproduce, stop-auth.ps1) and the TSS tool (TSS.ps1 -scenario ADS_AUTH) capture NetSetup.log and a network trace together.
