Active Directory domain join fails from the GUI: check the length of your password
Table of Contents
No matching heading
Sometimes the cause of a failed domain join is not in the domain at all. Here is one I chased for a while before finding it: the password was simply too long for the dialog.
Symptom
On a freshly installed Windows 11 workstation, joining the domain from System Properties fails with a generic error. The same happens on a Windows Server 2022 in another site, and even renaming a machine that is already in the domain fails as soon as you enter the domain credentials.
The credentials are correct: the same account logs on to the domain controllers without any issue. The DCs log nothing. Entra Password Protection is deployed, but the DCAgent logs are empty too. Changing the password, using a Tier 0 account, changing or shortening the computer name: same error every time.
Cause
The password of the account used for the join is too long. The dialog accepts it, sends the request and fails without any useful message. In my case the account had a passphrase of more than 30 characters, generated by a password manager. I did not look for the exact limit.
Solution
No need to shorten the password. The same credentials work from the command line:
netdom join WS-TEST02 /domain:contoso.local /ud:contoso\admin-t2-bperez /pd:*
Or with PowerShell:
Add-Computer -DomainName 'contoso.local' -Credential 'contoso\admin-t2-bperez' -Restart
Another option, useful when the machine cannot reach a domain controller during installation (VPN only after logon, remote site): the offline domain join. On an admin server:
djoin /provision /domain contoso.local /machine WS-TEST02 /savefile C:\temp\WS-TEST02.txt
Then on the workstation, from an elevated prompt:
djoin /requestodj /loadfile C:\temp\WS-TEST02.txt /windowspath %SystemRoot% /localos
Reboot, log on with the local account, connect the VPN, then switch to the domain account. Everything works.
Sometimes the problem is simply that you are too "secure" for the tool you are using. Keep the long password, use the command line.
