To join a domain in Windows 11, select Start > Settings > Accounts > Access work or school, select Connect, then choose Join this device to a local Active Directory domain. Enter the domain name, enter the credentials for an account that is allowed to join computers to the domain, and restart the PC.
These steps follow Microsoft Learn’s article on joining a computer to a domain, which also documents the Control Panel, Command Prompt and PowerShell methods covered below. A domain is a group of computers and user accounts that an organization manages centrally with Active Directory, so you need details from your IT team before you start. This guide is for a PC your organization has asked you to join; it can’t add a PC to a domain you don’t have an account for.
If you only need to check the computer’s current membership, use our guide to finding the domain name in Windows 11. You do not need to join again just to look up the name.
What You Need Before You Start
- A supported edition: Microsoft lists Enterprise, Pro, Pro Education and Pro for Workstations (and their N versions) as the client editions that can join a domain. Windows 11 Home is not on that list. Check yours in Settings > System > About under Windows specifications. If it says Home, see how to get Windows 11 Pro.
- Local administrator rights: Microsoft says the user account must have administrative privileges on the local machine.
- The exact domain name: for example, corp.example.com. Get it from your IT team rather than guessing.
- A domain account that can join computers: usually an account your IT team provides or types in for you. Microsoft notes that ordinary domain users are limited to joining 10 computers by default, and an organization can restrict that further.
- A connection to the organization’s network: the PC has to reach a domain controller (the server that runs the domain) and the organization’s DNS servers. At home, that normally means connecting to the work VPN first, if your organization allows joins over VPN.
- The correct date and time: Microsoft notes that domain computers keep their clocks in sync with the domain controller to avoid sign-in (Kerberos) problems.
An administrator can also create the computer’s account in Active Directory ahead of time, which is called prestaging. Microsoft describes this as optional.
Local Domain or Microsoft Entra ID?
The Connect button in Settings leads to two different kinds of join, and they are easy to mix up. A local Active Directory domain runs on your organization’s own servers. Microsoft Entra ID is Microsoft’s cloud identity service, formerly called Azure Active Directory, and you join it with a work or school email address instead of a domain name.
If your IT team gave you an email address and no domain name, you probably need the Entra option. Microsoft’s steps for that are in Join your work device to your work or school network. The rest of this article covers the local domain join only.
How to Join a Domain From Windows 11 Settings
Before you continue: joining a domain lets your organization manage the PC and apply its policies. Only join a computer your organization owns or has told you to join, and make sure you know the password for a local administrator account in case you need to sign in without the domain later.
- Select Start, select Settings, then select Accounts.
- Select Access work or school, then select Connect. A setup window opens and asks for an email address.
- Do not type an email address. Select Join this device to a local Active Directory domain instead.
- Enter the domain name and select Next.
- Enter the user name and password of the domain account that is allowed to join the PC, then select OK.
- If Windows shows any further prompts, such as an offer to add an account for the person who will use the PC, follow your IT team’s instructions for them.
- Restart the device.
After the restart, the PC is a member of the domain and you can sign in with your domain account.
Other Ways to Join a Domain
All three methods below do the same job. Use them if the Settings option is missing or if your IT team prefers a command.
Control Panel
- Select Start, type Control Panel, and press Enter.
- Make sure the View by menu at the top right is set to Category.
- Go to System and Security, then select System.
- Select Domain or workgroup. The System Properties window opens.
- On the Computer Name tab, select Change.
- Under Member of, select Domain, type the domain name, and select OK.
- Enter the credentials needed to join the domain and select OK.
Microsoft says a notification then confirms the device’s domain membership. Select OK, and you’re prompted to restart. Microsoft’s instructions for Windows 10 and older Windows Server versions reach the same window through Change settings or Advanced system settings, so the link name depends on your version.
PowerShell
Open an elevated (administrator) PowerShell window and run Microsoft’s two commands, replacing YourDomainName with your domain:
Add-Computer -DomainName "YourDomainName" -Credential (Get-Credential)
Restart-Computer
A box asks for the domain credentials. The PC restarts after the second command, so save your work first.
Command Prompt
In an elevated Command Prompt, Microsoft’s example is:
netdom join %COMPUTERNAME% /domain:YourDomainName /userd:DomainUsername /passwordd:*
Replace YourDomainName and DomainUsername with your values. The asterisk makes Windows prompt for the password instead of showing it on screen. Reboot afterward.
One catch: Microsoft’s netdom reference says the tool is available on servers with the Active Directory Domain Services role or on PCs with the matching Remote Server Administration Tools installed. If Windows 11 doesn’t recognize the command, use PowerShell instead or install the RSAT tools. For help opening the window, see how to open Command Prompt in Windows 11 or how to run Command Prompt as admin.
How to Confirm the Join Worked
- At sign-in: after the restart, sign in with the domain account your IT team gave you. They can tell you the exact user name format your organization uses.
- In Settings: open Settings > Accounts > Access work or school. The domain connection should be listed there.
- In System Properties: repeat the Control Panel steps as far as the Computer Name tab. It shows the domain the PC belongs to instead of a workgroup.
Our domain name guide has a PowerShell check as well.
How to Leave a Domain
Warning: once the PC leaves the domain, domain accounts can no longer be used to sign in to it. Microsoft’s steps have you sign back in with a local account afterward, so confirm that you have a working local administrator account first, and check with your IT team before removing a work PC. If you need one, see how to create a local account on Windows 11.
- Settings: go to Settings > Accounts > Access work or school, select the domain connection, select Disconnect, then Yes, and reboot.
- Control Panel: return to the Computer Name tab, select Change, choose Workgroup under Member of, type a workgroup name, select OK, and reboot.
- PowerShell: Microsoft’s command is
Remove-Computer -UnjoinDomainCredential (Get-Credential) -PassThru -Verbose -Restart, which restarts the PC after you enter the domain credentials.
Removing a cloud work account is a different process. Use our guide on removing an organization from Windows 11 for that.
Troubleshooting a Failed Domain Join
Most of these fixes need your IT team, but knowing the likely cause helps you tell them what happened. Microsoft’s domain join troubleshooting guidance lists the error codes in full.
The domain option is missing or unavailable
Check the edition in Settings > System > About. If the PC runs Windows 11 Home, it is not one of the editions Microsoft lists for joining a domain. Also confirm you are signed in with an account that has administrator rights on the PC.
Windows can’t find or contact the domain
Microsoft says DNS is one of the first things to check. Confirm the spelling of the domain name, make sure the PC is on the organization’s network or VPN, and ask IT whether the PC is using the organization’s DNS servers. A network device or firewall that blocks traffic between the PC and the domain controller causes similar errors.
The account isn’t allowed to join the PC
Microsoft’s error table links code 0x216d to an account that has passed the 10-computer limit or is blocked by Group Policy. Ask IT to perform the join or to grant your account permission.
A computer with the same name already exists
Windows updates released since October 11, 2022 include the hardening described in Microsoft’s KB5020276. It stops a join from reusing an existing computer account unless the person joining created that account or a domain administrator did. If a join that used to work now fails, give IT the computer name and the error code.
Sign-in fails after the join
Check that the PC’s date and time are correct. If you later see “The trust relationship between this workstation and the primary domain failed,” Microsoft’s fix is for an administrator to repair the secure channel or to remove the PC from the domain and join it again.
For any failure, Windows records the details in the file C:\Windows\Debug\netsetup.log, which Microsoft calls a valuable resource for troubleshooting. Your IT team may ask for it.
Frequently Asked Questions
Can Windows 11 Home join a domain?
Microsoft’s list of client editions that can join a domain includes Enterprise, Pro, Pro Education and Pro for Workstations, not Home. A Home PC would need to move to one of those editions first.
Do I need to restart after joining a domain?
Yes. Every method Microsoft documents ends with a restart, and the PowerShell method restarts the PC for you.
Do I need to be on the office network to join?
The PC must be able to reach a domain controller and the organization’s DNS while it joins. That means the office network or a VPN connection your organization has approved for this purpose.
Will my existing files and local account be deleted?
Microsoft’s instructions don’t describe the join removing local accounts, and they have you sign back in to a local account after leaving a domain. A domain account is a different account from your local one, though, so don’t expect the files and settings from your local account to appear when you sign in with it. Back up anything important before you join and ask IT how to move it.
Is joining a domain the same as adding a work or school account?
No. Adding a work or school account in Settings connects an account to apps and services, and a Microsoft Entra join uses the cloud. A local Active Directory domain join makes the computer itself a member of your organization’s on-premises domain.
Next Step
Once the PC is joined and you can sign in, administrators who manage the domain from Windows 11 can add the RSAT tools. Everyone else can simply sign in with the domain account and let the organization’s settings apply.
Matthew Burleigh has been writing tech tutorials since 2008. His writing has appeared on dozens of different websites and been read hundreds of millions of times.
After receiving his Bachelor’s and Master’s degrees in Computer Science he spent several years working in IT management for small businesses. However, he now works full time writing content online and creating websites.
His main writing topics include iPhones, Microsoft Office, Google Apps, Android, and Photoshop, but he has also written about many other tech topics as well.