There are several ways for Windows PCs to join an Active Directory domain. These include the interactive method via the System Properties applet, netdom.exe, and PowerShell. Other options include a provisioning package, an answer file, or an offline domain join by importing an ODJ file.

For the foreseeable future, most company PCs will belong to an on-prem Active Directory domain to simplify the management of devices and user accounts.

Connection to Azure AD

The now widespread integration into Azure AD is mostly done via a hybrid join, where PCs still join a local AD. The two directories are linked on the server side using AAD Connect, so this process is transparent to the clients.

Connecting a PC to Azure AD in a hybrid environment

Connecting a PC to Azure AD in a hybrid environment

Prerequisites for domain join

As in previous versions of Windows, there are still some prerequisites that must be met before a machine can join a domain. This includes a proper edition of the operating system; at least Windows 11 Pro is required.

In addition, the computer should use a DNS server that connects it to the domain controller (DC) via an SVR record. This is always the case if the domain name service is provided by Active Directory.

Advanced system properties GUI

In Windows 10, the Settings app took over an increasing number of control panel tasks. In earlier releases, this also included joining the computer to a domain. However, this option disappeared later on.

With Windows 11, the Settings app still does not offer a domain join function. The Domain or workgroup link under System > About opens the System Properties applet, which can also be started directly by entering sysdm.cpl.

The Settings app opens the System Properties applet for domain joining

The Settings app opens the System Properties applet for domain joining

You can also rename the PC there, which is usually necessary with new computers to comply with the company's naming convention.

PowerShell cmdlet Add-Computer

If you add a computer to a domain via the GUI, its account is automatically created in the Computer container, unless you have already prepared an account for the computer in the intended organizational unit (OU).

PowerShell, however, can join a PC to a domain, rename it, and assign it to an OU in one go. The Add-Computer cmdlet is responsible for this. Pass it the OU as a distinguished name:

Add-Computer -DomainName -NewName Win11 `
-OUPath "OU=Marketing,DC=contoso,DC=com" -Credential contoso\admin

The required reboot can also be achieved by adding the -Restart switch.

Join computers to a domain using PowerShell

Join computers to a domain using PowerShell

Add-Computer can also join remote computers to a domain via the ComputerName parameter. If you want to add several devices to the domain at the same time, pass the names to the command as a comma-separated list. However, with PCs that do not yet belong to a domain, you have to deal with notorious WinRM connection issues.


If you prefer to use the netdom.exe utility instead of PowerShell, you can also use it to join a PC to a domain. Unlike Add-Computer, it is only available after installing RSAT on a workstation. A command might look something like this:

netdom join <computername> / /UserD:<AuthorizedDomainUser> /PasswordD:* /OU:OU=finance,DC=contoso,DC=com

As you can see from this example, netdom can also create the computer account in a specific OU.

For the domain join, the program expects an authorized user from the domain for the UserD parameter. You can either pass the password to PasswordD or leave it there with a "*". Then, netdom queries the password interactively.

Provisioning package

Windows 10 introduced a new way to customize the operating system. The Imaging and Configuration Designer (ICD), a tool included with the Windows ADK, saves the settings for the so-called runtime provisioning in PPKG files.

Windows Setup automatically executes them during the OOBE phase, or alternatively, users can import them at runtime afterwards.

Such packages also handle the initial setup, which involves renaming the computer and joining a domain. You can do this by clicking the Deploy Desktop Devices tile after starting the ICD, entering the name and location of the project, and then traversing the wizard in five steps.

Create a provisioning package for domain join

Create a provisioning package for domain join

Under Account management, you can then enter the data for the domain join, including the authorized account and its password. However, assignment to an OU is not possible.

The PPKG file uses a binary format and can be secured with a password at the end.

Join the domain by running the PPKG file

Join the domain by running the PPKG file

The obvious advantage of this method is that you can, for example, send the package to remote users to join their PCs to the domain. However, for this task, they must be able to contact a Domain Controller over a VPN.

Offline join

If there is no connection between the PC and the domain controller, you still have the option of joining the domain offline. To do so, create the computer account in advance in Active Directory using djoin.exe, and save the result in a file:

djoin /provision /domain /machine Win11pro /savefile Win11pro.odj

If necessary, you can use machineou to specify the OU in which the account should be created.

The second step is to import the ODJ file to the relevant client:

djoin /requestodj /loadfile .\Win11pro.odj /windowspath c:\windows /localos

The localos switch tells the program that you want to join the live system to the domain.


With the exception of a provisioning package, all procedures are intended for domain joining of a live system. However, it is often the case that PCs need to be automatically added to an AD domain during deployment.

An answer file is useful for this task. If you create it with the Windows System Image Manager (Windows SIM), the relevant setting is found under amd64_Microsoft-Windows-UnattendedJoin_10.0.22621.1_neutral.

Drag this component to the specialize section of the answer file. Then enter the domain under Identification and the credentials under Credentials in the Properties window.

Create an answer file for joining an AD domain with Windows SIM

Create an answer file for joining an AD domain with Windows SIM

The result is the XML file below, which you can also use directly without running Windows SIM. Of course, you have to change the domain and credentials according to your environment:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="" xmlns:xsi="">
    <cpi:offlineImage cpi:source="wim:c:/users/public/install.wim#Windows 11 Pro" xmlns:cpi="urn:schemas-microsoft-com:cpi" />

The file should be named unattend.xml. After mounting the Windows image with DISM, copy it to the \Windows\Panther directory.


Joining a local AD domain is still a standard procedure for corporate PCs. The connection to Azure AD, e.g., for endpoint management using Intune, usually takes place via synchronization between the AD DS and the Cloud.

Microsoft provides different methods for joining a PC, depending on the scenario. The control panel applet and the command line (Add-Computer, Netdom.exe) are used for the interactive domain join.

Subscribe to 4sysops newsletter!

Provisioning packages are an interesting option because they can be used both on a live system and in a deployment image. An answer file automates the domain join during installation, and djoin.exe is available for purely offline scenarios.

  1. Aj sayne 4 months ago

    If you DO NOT know how to domain join a PC, YOU SHOULD NOT DOMAIN JOIN A PC

    • I guess this is a universal doctrine: If you do not know how to do x, you should not do x.

    • Author

      Come on, don’t be so arrogant! Did you really know all options for joining a domain mentioned in this article? Do you know who is allowed to join a computer to a domain by default and which restrictions apply for standard users? And how to delegate this permission? This topic is not as trivial as one might think.

    • Jules 4 months ago

      If you don’t know how to do it, well, you always can learn…

  2. ikangaya 3 months ago

    If i need to rejoin laptop/pc that already hostname (eg: to another hostname (eg:, can you give the PowerShell cmdlet?

    • Rename-Computer is the cmdlet you are looking for:

      Rename-Computer -ComputerName 'PcTech01' -NewName 'PcAdmin01' -DomainCredential domain\user -Force -Restart

Leave a reply

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account