How to Add a Computer to an Active Directory Domain (Windows)

Applies to: Windows Server 2016 to 2025, Windows 10 and 11 (Pro, Pro Education, Pro for Workstations and Enterprise); steps and error messages from Microsoft’s documentation, as Windows can’t run in our Docker test lab

To add a computer to an Active Directory domain, first point its DNS at a domain controller. Then join it in System Properties (Member of: Domain), in the Windows 10 or 11 Settings app, with Add-Computer in Windows PowerShell, or with netdom join, and restart. You need local administrator rights and a domain account that may join computers.

Before you start

• Windows edition. Microsoft lists Pro, Pro Education, Pro for Workstations and Enterprise editions of Windows 10 and 11 (and their N versions) as able to join. Home editions are not on the list.
• DNS. The computer’s preferred DNS server must be one that can resolve the domain, normally a domain controller. See change DNS settings. Type the domain’s DNS name (contoso.com), not the short NetBIOS name (CONTOSO).
• Network path. The computer must reach a domain controller on the Active Directory ports. For a server hosted away from the office, such as a Windows VPS, connect it to the office network over a VPN; don’t open domain controller ports to the internet.
• Time. Domain members normally take their time from the domain controller. Microsoft notes that consistent clocks avoid problems with Kerberos sign-in, so fix a badly wrong clock first.

Microsoft’s test that the computer can find a domain controller, from Command Prompt:

nltest /dsgetdc:contoso.com /force

Method 1: System Properties (Windows Server and Windows 10 or 11)

1. Open Control Panel (View by: Category), System and Security, System. Then, on Windows Server 2025 and Windows 11, select Domain or workgroup; on Windows Server 2022, Advanced system settings and Change settings; on Windows Server 2019, 2016 and Windows 10, Change settings under Computer name, domain, and workgroup settings. On Windows Server you can also open Server Manager, Local Server and select the workgroup name.
2. On the Computer Name tab, select Change.
3. Under Member of, select Domain, type the domain name and select OK.
4. Enter the domain account and password, then OK.
5. When the confirmation appears, select OK and restart the computer.

Method 2: Settings app (Windows 10 and 11)

1. Start, Settings, Accounts, Access work or school, Connect.
2. Select Join this device to a local Active Directory domain.
3. Enter the domain name, select Next, enter the domain credentials, then restart.

Method 3: Windows PowerShell

Open Windows PowerShell (powershell.exe) as administrator. According to Microsoft, Add-Computer was removed from PowerShell 7 (pwsh.exe), so use version 5.1 for this:

Add-Computer -DomainName "contoso.com" -Credential (Get-Credential) -Restart

Useful extra parameters from Microsoft’s reference:

• -OUPath "OU=Servers,DC=contoso,DC=com" creates the computer account in a specific organisational unit.
• -NewName SRV-WEB01 renames the computer in the same step.
• -Server DC1.contoso.com picks the domain controller. Since the domain join hardening updates, Microsoft requires the controller’s full name (FQDN) here.

Method 4: netdom in Command Prompt

netdom join %COMPUTERNAME% /domain:contoso.com /userd:contoso\admin /passwordd:*

The * makes it ask for the password. Add /reboot to restart automatically (after 20 seconds by default). Microsoft notes that netdom is available where the AD DS role is installed or with the AD DS tools from RSAT.

If the join fails

• “An attempt to resolve the DNS name of a DC in the domain being joined has failed”: a DNS problem. Check the preferred DNS server, use the full DNS domain name and run the nltest command above.
• “The remote procedure call failed and did not execute”: a firewall, router or VPN is blocking the ports Active Directory needs.
• “The trust relationship between this workstation and the primary domain failed” (later, on a computer that was joined): sign in with a local administrator and run Test-ComputerSecureChannel -Repair -Credential (Get-Credential) in Windows PowerShell, then restart.

Details of every join attempt are in %windir%\debug\NetSetup.log.

Leave a domain

In Windows PowerShell 5.1 (like Add-Computer, this cmdlet isn’t in PowerShell 7):

Remove-Computer -UnjoinDomainCredential (Get-Credential) -PassThru -Verbose -Restart

Or in System Properties, switch Member of back to Workgroup. Make sure you know a local administrator password first.

Joining Linux servers to the same domain: join Linux to Active Directory with realmd and SSSD. Working on a remote Windows server: connect with Remote Desktop and Command Prompt compared with PowerShell.

Official documentation: join a computer to a domain, Add-Computer and domain join networking errors.