Error Message:An account with same name exists in Active Directory. Re-use the account was blocked by security policy.

Hello Jin,

Thank you for posting question on Microsoft Windows Forum!

Based on the provided error message "An account with same name exists in Active Directory. Re-use the account was blocked by security policy." which might stem from a security hardening update introduced by Microsoft (KB5020276). It prevents standard users or non-owner administrators from re-using an existing computer account when joining a machine to Active Directory. By default, Active Directory now blocks the join unless the account performing the join is the exact creator/owner of the original computer object, or a Domain Admin.

The reason for that is either the account you are currently using to join the domain is not the original creator of the computer account that already exists in Active Directory or the computer account was pre-staged by a domain admin, but the account you are using to join the domain does not have sufficient permissions to "claim" or adopt that existing object.

The potential impact of deleting the AD computer account might server the secure communication channel between that specific machine and the domain. While the computer might still allow login for a short time, it will quickly lose access to domain resources and will show errors on subsequent operations. If domain users have local profiles cached on that machine, after you delete the account and rejoin the domain, those old local profile folders might not be accessible by the new account. This usually requires manually fixing folder permissions (ACLs). On the other hand, the newly created computer account will receive a brand-new SID. Any applications or services that rely on the old SID for authorization (e.g., specific file shares, SQL Server permissions, or custom scripts) may break and require reconfiguration.

The suggestion in this scenario is to use the original creator account. If you know and have access to the account that was originally used to create the computer object in AD, simply use that same account to perform the domain join.

Hope the above information is helpful!