24H2 Adding to Domain Issue

[ITGURU]

I've always pre-created AD Computer accounts in the necessary OU's so that after an image, use the network id wizard to join to the domain. It says account found, do you want to use it and say yes to continue through,

However on 24h2 it seems this cannot be done.

If the account exists, it finds it but then says an AD controller for the domain cannot be found. - DNS name does not exist.

However, if i delete the AD account,re-run the wizard, it lets me go through and it creates the account but only in the default OU.

Any workarounds/solutions to this?

[CHiLL]

What are you using to image computers? We've been using SCCM for a decade and use it's automated network joining during the imaging process. We can amend the name before the TS starts or leave it as default and change it manually later. I believe MDT can do this too.

[evasion]

Pretty much the same experience with 24h2 version. REcover domain TS fails (seen in logs) but script reports success, domain join does not happen if using existing computer name. No such issues with previous version 23h2. However, PS script does the trick, only problem is having to input creds manually, which is no longer "zero-touch" approach.

[highsky]

I suspect is the new hardening rules. 

 

There's is a gpo setting to allow reuse of existing devices to rejoin and witch groups or users are allowed to do so

[mavhc]

Check for any deny permissions on the computer object

[psydii]

I think only Administrator and the Creator Owner have permission to modify computer accounts now... and the default passwords for computers I think has also been changed/hardened which might also cause problems depending on how you manage accounts. [...skim reading the page at the link below, I now think I slightly wrong... but things have changed and this is probably the cause of the issue, and point to how your should update your processes]

KB5020276—Netjoin: Domain join hardening changes - Microsoft Support

Edited October 10, 2025 by psydii

[Davit2005]

What permissions have you given the account used to join to the Domain to the OU? I used delegated roles and not a domain admin then jus gave it the permissions to the relevant OU. Are the permissions still enough?

 

What happens if you remove a PC from the domain and re-add. Do you still get the issue?

[evasion]

permissions do exist on the account used to join domain, it has delegated role. Domain security policy does allow re-use of existing computer accounts. As I said power shell script will join domain if existing computer account is re-used. "Recover form domain" step in task sequence no longer works as before if existing account is re-used.

 

Edited October 10, 2025 by evasion

[MatthewL]

Why do you pre-create them?  Surely just let it create them as you join and then move them.

[evasion]

2 minutes ago, MatthewL said:

Why do you pre-create them?  Surely just let it create them as you join and then move them.

When replacing old computers with new, usual procedure is to image new computer with existing old computer name. That way new computer is placed in the same OU as the old one. Been like that since days of Windows XP. Now this latest version of Win11 24h2 is not happy with resolving domain name during imaging. NetSetup.log shows this: " NetpJoinDomainOnDs: Domain name is invalid, NetpValidateName returned: 0x54b". So domain join fails @ Recover from domain step. When using powershell script inserted instead of that step, it will join domain. 

[evasion]

Success: changed details in customsettings.ini to show FQDN instead of single label domain name: 

JoinDomain=FQDN
DomainAdminDomain=FQDN

 

NetSetup.log shows success code now, also allow reuse of computer name works.

thanks to reading this : https://learn.microsoft.com/en-us/answers/questions/2192023/window-11-24h2-cant-join-domain?page=14#answers