Windows 11 Cannot Join Domain — How to Fix

Overview

Joining a Windows 11 PC to an Active Directory domain should be straightforward, but it fails more often than you would expect. The most common error messages are:

• "The specified domain either does not exist or could not be contacted"
• "The join operation was not successful"
• "Your computer could not be joined to the domain — the maximum number of computer accounts has been reached"
• "Access is denied"

This guide covers every common cause and fix, ordered by likelihood.

Fix 1: DNS Configuration (Most Common)

The number one reason domain join fails is that the PC cannot find the domain controller because its DNS is pointing to the wrong server.

Check current DNS

ipconfig /all | findstr "DNS Servers"

The DNS server must point to a domain controller (or a DNS server that hosts the AD-integrated zone). If it points to 8.8.8.8, 1.1.1.1, or your ISP's DNS, domain join will fail.

Fix DNS

# Set DNS to the domain controller IP (replace with your DC's IP)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses "192.168.1.10","192.168.1.11"

Verify DNS resolution

# This must resolve to your domain controller(s)
nslookup corp.example.com

# SRV records must exist
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.example.com

If nslookup fails, DNS is the problem. Fix it before trying anything else.

Fix 2: Network Connectivity

The PC must be able to reach the domain controller on the correct ports.

Test connectivity

# Test LDAP
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 389

# Test Kerberos
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 88

# Test DNS
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 53

# Test SMB (for Group Policy download)
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 445

All four tests must succeed. If any fail, check:

• Firewall rules on the PC and DC
• VPN connectivity (if joining remotely)
• VLAN/subnet routing between the PC and DC

Fix 3: Computer Account Limit Reached

By default, authenticated users can join up to 10 computers to the domain. After that, you get "the maximum number of computer accounts has been reached."

Check the current limit

# Run on the domain controller
Get-ADDomain | Select-Object -ExpandProperty ms-DS-MachineAccountQuota

Fix — Pre-stage the computer account

Instead of increasing the limit (which is a security risk), pre-stage the computer account:

1. Open Active Directory Users and Computers on the DC
2. Navigate to the target OU
3. Right-click > New > Computer
4. Enter the computer name
5. On the PC, join the domain — it will use the pre-staged account

Alternatively, delegate domain join rights to a specific group:

# Grant a group the right to join computers to a specific OU
dsacls "OU=Workstations,DC=corp,DC=example,DC=com" /G "CORP\IT-Staff:CC;computer"

Fix 4: Secure Channel Broken (Rejoining)

If a PC was previously joined and its computer account password has expired (common after being off the network for 30+ days), you will see "the trust relationship between this workstation and the primary domain failed."

Fix without reimaging

# Run as local admin on the affected PC
# Remove from domain (use local admin credentials)
Remove-Computer -UnjoinDomainCredential (Get-Credential) -Force -Restart

# After reboot, rejoin the domain
Add-Computer -DomainName "corp.example.com" -Credential (Get-Credential) -OUPath "OU=Workstations,DC=corp,DC=example,DC=com" -Restart

Or reset the secure channel without removing/rejoining:

# Run as a domain user with rights to reset the computer account
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Fix 5: Time Synchronisation

Kerberos authentication fails if the time difference between the PC and domain controller exceeds 5 minutes.

Check time difference

# On the PC
w32tm /stripchart /computer:dc01.corp.example.com /dataonly /samples:3

Fix

# Force time sync to the domain controller
w32tm /resync /force

If the PC is not yet domain-joined, manually set the time or configure NTP:

Set-Service -Name w32time -StartupType Automatic
Start-Service w32time
w32tm /config /manualpeerlist:"dc01.corp.example.com" /syncfromflags:manual /update
w32tm /resync

Fix 6: Windows 11 Edition

Windows 11 Home cannot join an Active Directory domain. This is a hard limitation — no workaround exists.

Check edition

(Get-CimInstance -ClassName Win32_OperatingSystem).Caption

If it reports "Windows 11 Home", the PC must be upgraded to Pro, Enterprise, or Education.

Upgrade from Home to Pro

1. Go to Settings > System > Activation
2. Click Change product key
3. Enter a Windows 11 Pro product key
4. Restart and attempt domain join again

Fix 7: IPv6 Issues

In some network configurations, IPv6 can interfere with domain join, especially if IPv6 DNS resolution returns incorrect results.

Temporary fix

Disable IPv6 on the network adapter:

Disable-NetAdapterBinding -Name "Ethernet" -ComponentID ms_tcpip6

Diagnostic Summary