How to Verify Requirements for Joining a Domain

To join or log on to a domain successfully, you must meet several different requirements. When troubleshooting a problem joining a domain, verify each of these requirements:

• The client computer must be able to resolve the IP address for a domain controller In most enterprise networks, client computers receive an IP address assignment from a DHCP server, and the DHCP server provides addresses for AD DS- enabled DNS servers that can resolve the domain controller IP address. If another DNS server is configured, you should update the client computer's IP configuration to use an AD DS-enabled DNS server. If this is not possible, you can add two records to your existing DNS server that resolve to a domain controller's IP address:
  • The _ldap._tcp.dc._msdcs.DNSDomainName SRV resource record, which identifies the name of the domain controller that hosts the AD DS domain. DNSDomainName is the DNS name of the AD DS domain the computer is attempting to join.
  • A corresponding address (A) resource record that identifies the IP address for the domain controller listed in the _ldap._tcp.dc._msdcs.DNSDomainName SRV resource record.
• The client computer must be able to exchange traffic with the domain controller on several different TCP and UDP ports These ports include:
  • TCP port 135 for RPC traffic
  • TCP port 389 and UDP port 389 for LDAP traffic
  • TCP port 636 for LDAP over SSL traffic
  • TCP port 3268 for LDAP Global Catalog (GC) traffic
  • TCP port 3269 for LDAP GC SSL traffic
  • TCP port 53 and UDP port 53 for DNS traffic
  • TCP port 88 and UDP port 88 for Kerberos traffic
  • TCP port 445 for SMB (also known as CIFS) traffic
  Note For information about determining whether specific ports are available, see the section titled "How to Troubleshoot Application Connectivity Problems" earlier in this tutorial. The easiest way to test for all of these ports at one time is to use Portqueryui. exe and the "Domains and Trusts" predefined service.
• The administrator must have privileges to add a computer to a domain Administrators who add a computer to a domain must have the Add Workstations To Domain user right.
• The computer must be running Windows 7 Professional, Windows 7 Enterprise, or Windows 7 Ultimate Windows 7 Starter, Windows 7 Home Basic, and Windows 7 Home Premium operating systems cannot join a domain.