I have just finished setting up my first domain controller for the office and now I need to actually get the staff laptops onto the domain so people can log in with their domain accounts and pick up group policy. I tried on one Windows 11 laptop but it either could not find the domain or threw an error about credentials. What is the correct way to join a Windows machine to the domain, and what do I need in place first so it does not keep failing?
How to Join a Windows Computer to an Active Directory Domain
Resolved
Data Recovery
CM
Community Member August 11, 2026
6 replies
1,184 views
Reviewed by moderators
6 Answers
Most failed domain joins come down to one of a few prerequisites, so get these right first and the join itself takes two minutes:
Windows edition: the PC must run Pro, Enterprise, or Education. Windows 11 Home cannot join a traditional AD domain at all, that alone stops many people. DNS: the PC's DNS server must point to your domain controller's IP address, not a router or a public resolver like 8.8.8.8, because AD uses DNS to locate the DC. Network: the PC must reach the DC on the LAN or over VPN, test with a ping to the DC. Local admin on the PC, plus a domain account allowed to join machines. And keep the clock in sync, Kerberos fails if the PC and DC differ by more than about five minutes.
The "cannot find the domain" error is almost always the DNS setting. Fix it on the client before anything else.
Run ncpa.cpl, right-click your adapter, Properties, open Internet Protocol Version 4 (TCP/IPv4), choose "Use the following DNS server addresses" and set the Preferred DNS server to your domain controller's IP (for example 192.168.1.10). If you do not know the DC's IP, run ipconfig on the DC itself. Once the client uses AD DNS, run ping dc01.corp.example.com to confirm it can resolve and reach the controller. Only then attempt the join.
The classic method works on every Windows version. Open the Run dialog and type sysdm.cpl to open System Properties. On the Computer Name tab click Change. Rename the PC now if you need to (do it before joining, renaming afterward forces another reboot and re-establishes trust). Under "Member of" select Domain and type your domain name, for example corp.example.com, then click OK.
You will be prompted for credentials, enter a domain account allowed to join machines in the form DOMAIN\username with its password. You should get a "Welcome to the domain" message. Restart the PC, then sign in with a domain account.
On Windows 11 specifically you can also use the Settings app: go to Settings, Accounts, Access work or school, click Connect, then choose "Join this device to a local Active Directory domain". Enter the fully qualified domain name and authenticate. It ends the same way, a restart and then a domain login. Note the Settings app does not have a standalone domain-join button on the main page, so sysdm.cpl is still the most reliable route if you cannot find it.
To script it or do many machines, PowerShell is the fastest. On the client, run as administrator:
Add-Computer -DomainName "corp.example.com" -Credential (Get-Credential) -Restart
It prompts for the domain credentials, joins the machine, and reboots automatically. This is ideal for rolling out a batch of laptops, since you can push it through your deployment tool rather than clicking through the GUI on each one.
If a join still fails after DNS is correct, two things to check. An "account already exists" or trust error usually means a stale computer object is left in AD from a previous attempt, either delete or reset that object in Active Directory Users and Computers, or rename the PC, then retry. And confirm the account you are using actually has rights to join, by default authenticated users can join a limited number of machines, but that quota or delegated permissions can block you. Once joined, the domain's group policies apply on the next reboot and users can sign in with their domain accounts.