Window 11 24H2 / Can't Join Domain

It took forewer, but abracadabra:

disable IPv6. / restart

done.

nltest /dsgetdc:<domainname>

nslookup -type=SRV _ldap._tcp.dc._msdcs.<domainname>

Run these commands from windows clients, and confirm SRV location for your domain is available on DNS server. If not good to update. Give a try.

OK -- I run these commands on an older system, and whether I use the older NetBIOS name of simply "NAME" or if I use the full "NAME.ORG.COM", I get back the same data fro either command, and all is well.

On my 24H2 laptop, though, I get the same (good) results from NAME.ORG.COM, but for just NAME, I get Status 1355, No Such Domain on the NLTEST request.

Both machines use the same DHCP server (one of the DC's). Both machines use the same DNS servers (the two DC's in the domain). Both machines are using the same logins. I tried enabling the AllowSingleLabelDnsDomain setting in the registry, but no change. This is quite maddening.

Hi Everyone,

I encountered the same issue, specifically with my 24H2 OSD deployment. Every time I deployed 23H2, the OS installation and domain join were successful. However, with 24H2, I ran into problems. Upon checking the NetSetup.log, I noticed that the Setup Config Manager step took 20 minutes, during which the following errors occurred:

- NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac

- NetpProvisionComputerAccount: LDAP creation failed: 0xaac

As a result, the client could not join the domain.

I found an Article indicating that if the OS was patched with the August 13, 2024 update, even 23H2 would fail due to NetJoinLegacyAccountReuse.

The issue arises if:

• The user attempting the operation is the creator of the existing account.
• The computer was created by a member of domain administrators.
• The owner of the computer account being reused is part of the "Domain controller: Allow computer account re-use during domain join" Group Policy setting.

This setting requires the installation of Windows updates released on or after March 14, 2023, on all member computers and domain controllers.

**Solution:**

Configure the new allow list policy using Group Policy on a domain controller and remove any legacy client-side workarounds. Follow these steps:

1. Install the September 12, 2023, or later updates on all member computers and domain controllers.
2. In a new or existing group policy that applies to all domain controllers, configure the settings as follows:
   • Navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options
   • Double-click Domain controller: Allow computer account re-use during domain join
   • Select Define this policy setting and ``
   • Use the object picker to add users or groups of trusted computer account creators and owners to the Allow permission (preferably using groups for permissions). Do not add the user account performing the domain join.

**Warning:**

Limit membership to the policy to trusted users and service accounts. Do not add authenticated users, everyone, or other large groups. Instead, add specific trusted users and service accounts to groups, then add those groups to the policy.

3. Wait for the Group Policy refresh interval or run gpupdate /force on all domain controllers.
4. Verify that the HKLM\System\CCS\Control\SAM – "ComputerAccountReuseAllowList" registry key is populated with the desired SDDL. Do not manually edit the registry.
5. Attempt to join a computer with the September 12, 2023, or later updates installed. Ensure one of the accounts listed in the policy owns the computer account. If the domain join fails, check the c:\windows\debug\netsetup.log.

If additional workarounds are needed, review computer account provisioning workflows and understand if changes are required. Here are some options:

• Perform the join operation using the same account that created the computer account in the target domain.
• If the existing account is stale (unused), delete it before attempting to join the domain again.
• Rename the computer and join using a different account that doesn’t already exist.
• If the existing account is owned by a trusted security principal and an administrator wants to reuse the account, follow the guidance in the Take Action section to install the September 2023 or later Windows updates and configure an allow list.

**I have opened a case with Microsoft and have received confirmation that the above is a solution to this problem**.

I had the same problem with a "mydom." without tld .lan, .local .

The problem was present both on 23H2 and 24H2

Here is the fix I found and solved the problem :

On each DC :

KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\AllowSingleLabelDnsDomain  (dword 1)

On computer :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DnsCache\Parameters\UpdateTopLevelDomainZones (dword 1)

Restart computer and join on "mydomain." (do not forget the "." to validate tld )

same story here with same results.

Are we even sure this problem lands at Microsoft? till now no relpy from moderator, technician or something.

just silence...