Domain Join VM To Entra Domain Services fails with the user name or password is incorrect

Question

Domain Join VM To Entra Domain Services fails with the user name or password is incorrect

GerryNicol 21

When trying to join a vm to entra domain services I get 'The user name or password is incorrect'.

I have set up as follows

User is a member of AAD DC Administrators
NTLM password synchronization is enabled
I have reset the password of two account to test and waited for the sync

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T16:11:26.5433333+00:00

Hello GerryNicol ,

From an AAD DS object synchronization perspective, the behavior is expected. Although the two older accounts were cloud-only and members of AAD DC Administrators, they were not synchronized into Entra Domain Services. AAD DS operates as a separate managed domain with a one-way sync, and any account that does not exist in the managed domain cannot authenticate. In this scenario, the domain join returns the generic error “The user name or password is incorrect.”

The key indicator was that these users did not appear in ADUC. When a user object is missing from the managed domain, AAD DS treats the credentials as invalid because the security principal does not exist.

This also explains why:

Multiple password resets did not resolve the issue

Group membership alone had no effect

A newly created cloud-only user worked immediately

Cloud-only users created after AAD DS is enabled generate NTLM/Kerberos password hashes at creation time and are synchronized into the managed domain automatically. This is why the new account appeared in ADUC and was able to join the VM successfully.

Once the older users were synchronized and visible in ADUC, the domain join completed successfully.

For Entra Domain Services, authentication depends on the user existing in the managed domain, not just in Entra ID. If the account is not present in ADUC, domain join will fail with a credentials error regardless of password resets or admin group membership.
GerryNicol 21 Reputation points

2025-12-11T16:16:02.3866667+00:00

I have done all those
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T16:26:16.43+00:00
GerryNicol The error “The user name or password is incorrect” during Entra Domain Services domain join usually indicates that the account being used does not have NTLM/Kerberos password hashes available in AAD DS, even if it is in AAD DC Administrators and password hash sync is enabled.

In your case, the likely issue is the source of the user accounts. Accounts with a source of “Microsoft account” or “External Azure Active Directory (Guest)” cannot generate the required NTLM/Kerberos password hashes for AAD DS, so domain join will always fail with a credentials error. This is a known limitation of Azure AD Domain Services.

To resolve this:

Create a native Entra ID (Azure Active Directory) user

Reset the password (this triggers hash generation)

Wait 15–20 minutes for password hash synchronization to AAD DS

Add the user to AAD DC Administrators

Use this account to join the VM

Once you use a native AAD account (source = Azure Active Directory), domain join succeeds because only these accounts fully synchronize the required password hashes to Entra Domain Services Ensure that you are using credentials for a user account that is part of the managed domain. If you are using a cloud-only account, the user must change their password to generate the necessary password hashes for Kerberos and NTLM authentication.
GerryNicol 21 Reputation points

2025-12-11T16:30:14.36+00:00

My accounts being used are cloud only
GerryNicol 21 Reputation points

2025-12-11T16:45:04.17+00:00

I just tested created a brand new cloud only account and that has worked. The existing cloud only accounts which I followed the same process for don't work
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T17:04:52.4766667+00:00
This behavior is expected in some cases with Azure AD Domain Services (AAD DS). A newly created cloud‑only user works because its NTLM/Kerberos password hashes are generated immediately when you set the initial password after AAD DS is already enabled.

For older cloud‑only users, even if they appear similar, their password hashes may not regenerate correctly unless a full password change (not reset) is performed after AAD DS is provisioned. AAD DS can only synchronize hashes created after its deployment.

To fix the older accounts:

What you need to do

Have the affected user perform an actual password change themselves (not an admin reset).

Password change = works

Password reset = may not regenerate classic hashes

Wait 20–30 minutes for AAD DS to sync the updated NTLM/Kerberos credentials.

Try the domain join again using ******@domain.com.

This forces Entra ID to generate the required legacy authentication hashes and synchronize them to your managed domain.

Why a new user worked

New cloud‑only users created after AAD DS was enabled always generate the correct password hashes on first-time password setup that’s why they join successfully immediately.
GerryNicol 21 Reputation points

2025-12-11T17:07:41.4066667+00:00

That wasnt the issue. The issue appears to be that the two previous cloud only accounts i was using (even though they have beed added to the AAD DC Admin group) were not synced? I can see that now that I have access to ADUC
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T17:40:38.66+00:00
GerryNicol Even though the two older cloud‑only accounts were added to AAD DC Administrators, they were never synchronized into Azure AD Domain Services (AAD DS). Because AAD DS uses its own managed domain with a one‑way object sync, an account must fully synchronize into the AAD DS directory before it can authenticate during a VM domain join.

If the users weren’t synced into AAD DS, they simply do not exist in the managed domain so AAD DS treats the login as invalid and returns “The user name or password is incorrect.”

By checking ADUC and not seeing those accounts present, you confirmed the root cause.

Why the new cloud‑only user worked

A brand‑new cloud‑only user automatically:

Generates fresh password hashes

Syncs into the managed domain (AAD DS)

Appears in ADUC

Can authenticate successfully

This is why the domain join succeeded for that account but not for the older ones.

How to fix older cloud‑only accounts

To force these older users to sync into AAD DS:

Have the user perform a full password change (not an admin reset).

Wait 20–30 minutes for AAD DS to pull the updated credentials into the managed domain.

Verify the account appears under AAD DC Users in ADUC.

Retry the domain join.

Once the accounts exist inside the managed domain, VM join succeeds as expected.
GerryNicol 21 Reputation points

2025-12-11T19:37:50.1066667+00:00

The above was done - I already confimred that. A password reset was done on two seperate accounts on multiple occassions.
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-12T11:12:10.05+00:00

GerryNicol Thanks for confirming. If you already reset the passwords multiple times and the users were still not appearing in Azure AD Domain Services, then the root cause is that those cloud-only accounts were never synchronized into the managed domain at all, despite the password resets.

This happens when the accounts were created before AAD DS was enabled and never had a valid legacy password hash generated for AAD DS. Even after resetting the password, AAD DS sometimes won’t sync the account until:

Password hash sync is re-triggered for the user (another password reset from the Entra portal normally forces it)

AAD DS completes its internal replication cycle (which can take 20–40 minutes after the hash is ready)

The user object is re-evaluated for inclusion in the managed domain

This is why you could finally see the accounts in ADUC, and once they appeared there, domain join immediately started working.
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-15T09:05:25.6733333+00:00

GerryNicol Could you review my previous response and let me know if you need any additional information or further support?

Your answer

VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T16:11:26.5433333+00:00

Hello GerryNicol ,

From an AAD DS object synchronization perspective, the behavior is expected. Although the two older accounts were cloud-only and members of AAD DC Administrators, they were not synchronized into Entra Domain Services. AAD DS operates as a separate managed domain with a one-way sync, and any account that does not exist in the managed domain cannot authenticate. In this scenario, the domain join returns the generic error “The user name or password is incorrect.”

The key indicator was that these users did not appear in ADUC. When a user object is missing from the managed domain, AAD DS treats the credentials as invalid because the security principal does not exist.

This also explains why:

Multiple password resets did not resolve the issue

Group membership alone had no effect

A newly created cloud-only user worked immediately

Cloud-only users created after AAD DS is enabled generate NTLM/Kerberos password hashes at creation time and are synchronized into the managed domain automatically. This is why the new account appeared in ADUC and was able to join the VM successfully.

Once the older users were synchronized and visible in ADUC, the domain join completed successfully.

For Entra Domain Services, authentication depends on the user existing in the managed domain, not just in Entra ID. If the account is not present in ADUC, domain join will fail with a credentials error regardless of password resets or admin group membership.
GerryNicol 21 Reputation points

2025-12-11T16:16:02.3866667+00:00

I have done all those
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T16:26:16.43+00:00

GerryNicol The error “The user name or password is incorrect” during Entra Domain Services domain join usually indicates that the account being used does not have NTLM/Kerberos password hashes available in AAD DS, even if it is in AAD DC Administrators and password hash sync is enabled.

In your case, the likely issue is the source of the user accounts. Accounts with a source of “Microsoft account” or “External Azure Active Directory (Guest)” cannot generate the required NTLM/Kerberos password hashes for AAD DS, so domain join will always fail with a credentials error. This is a known limitation of Azure AD Domain Services.

To resolve this:

Create a native Entra ID (Azure Active Directory) user

Reset the password (this triggers hash generation)

Wait 15–20 minutes for password hash synchronization to AAD DS

Add the user to AAD DC Administrators

Use this account to join the VM

Once you use a native AAD account (source = Azure Active Directory), domain join succeeds because only these accounts fully synchronize the required password hashes to Entra Domain Services Ensure that you are using credentials for a user account that is part of the managed domain. If you are using a cloud-only account, the user must change their password to generate the necessary password hashes for Kerberos and NTLM authentication.
GerryNicol 21 Reputation points

2025-12-11T16:30:14.36+00:00

My accounts being used are cloud only
GerryNicol 21 Reputation points

2025-12-11T16:45:04.17+00:00

I just tested created a brand new cloud only account and that has worked. The existing cloud only accounts which I followed the same process for don't work
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T17:04:52.4766667+00:00

This behavior is expected in some cases with Azure AD Domain Services (AAD DS). A newly created cloud‑only user works because its NTLM/Kerberos password hashes are generated immediately when you set the initial password after AAD DS is already enabled.

For older cloud‑only users, even if they appear similar, their password hashes may not regenerate correctly unless a full password change (not reset) is performed after AAD DS is provisioned. AAD DS can only synchronize hashes created after its deployment.

To fix the older accounts:

What you need to do

Have the affected user perform an actual password change themselves (not an admin reset).

Password change = works

Password reset = may not regenerate classic hashes

Wait 20–30 minutes for AAD DS to sync the updated NTLM/Kerberos credentials.

Try the domain join again using ******@domain.com.

This forces Entra ID to generate the required legacy authentication hashes and synchronize them to your managed domain.

Why a new user worked

New cloud‑only users created after AAD DS was enabled always generate the correct password hashes on first-time password setup that’s why they join successfully immediately.
GerryNicol 21 Reputation points

2025-12-11T17:07:41.4066667+00:00

That wasnt the issue. The issue appears to be that the two previous cloud only accounts i was using (even though they have beed added to the AAD DC Admin group) were not synced? I can see that now that I have access to ADUC
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-11T17:40:38.66+00:00

GerryNicol Even though the two older cloud‑only accounts were added to AAD DC Administrators, they were never synchronized into Azure AD Domain Services (AAD DS). Because AAD DS uses its own managed domain with a one‑way object sync, an account must fully synchronize into the AAD DS directory before it can authenticate during a VM domain join.

If the users weren’t synced into AAD DS, they simply do not exist in the managed domain so AAD DS treats the login as invalid and returns “The user name or password is incorrect.”

By checking ADUC and not seeing those accounts present, you confirmed the root cause.

Why the new cloud‑only user worked

A brand‑new cloud‑only user automatically:

Generates fresh password hashes

Syncs into the managed domain (AAD DS)

Appears in ADUC

Can authenticate successfully

This is why the domain join succeeded for that account but not for the older ones.

How to fix older cloud‑only accounts

To force these older users to sync into AAD DS:

Have the user perform a full password change (not an admin reset).

Wait 20–30 minutes for AAD DS to pull the updated credentials into the managed domain.

Verify the account appears under AAD DC Users in ADUC.

Retry the domain join.

Once the accounts exist inside the managed domain, VM join succeeds as expected.
GerryNicol 21 Reputation points

2025-12-11T19:37:50.1066667+00:00

The above was done - I already confimred that. A password reset was done on two seperate accounts on multiple occassions.
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-12T11:12:10.05+00:00

GerryNicol Thanks for confirming. If you already reset the passwords multiple times and the users were still not appearing in Azure AD Domain Services, then the root cause is that those cloud-only accounts were never synchronized into the managed domain at all, despite the password resets.

This happens when the accounts were created before AAD DS was enabled and never had a valid legacy password hash generated for AAD DS. Even after resetting the password, AAD DS sometimes won’t sync the account until:

Password hash sync is re-triggered for the user (another password reset from the Entra portal normally forces it)

AAD DS completes its internal replication cycle (which can take 20–40 minutes after the hash is ready)

The user object is re-evaluated for inclusion in the managed domain

This is why you could finally see the accounts in ADUC, and once they appeared there, domain join immediately started working.
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2025-12-15T09:05:25.6733333+00:00

GerryNicol Could you review my previous response and let me know if you need any additional information or further support?