Skip to content

Commit 800b98d

Browse files
author
Simonx Xu
authored
Merge pull request #8531 from v-lianna/CI_4463
AB#4463 status-code-0x32-cannot-join-domain
2 parents 9ed1e3a + 0719422 commit 800b98d

File tree

2 files changed

+116
-0
lines changed

2 files changed

+116
-0
lines changed

‎support/windows-server/active-directory/status-code-0x32-cannot-join-domain.md‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
title: Status Code 0x32 and You Can't Join a Domain
3+
description: Helps resolve an issue in which you can't join a domain with status code 0x32. This issue is related to the failure to establish an SMB session to a DC.
4+
ms.date: 03/26/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika, raviks, herbertm, dennhu, eriw, v-lianna
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Status code 0x32 and you can't join a domain
14+
15+
This article helps resolve an issue in which you can't join a domain with status code 0x32. This issue is related to the failure to establish a Server Message Block (SMB) session to a domain controller (DC).
16+
17+
You fail to join a domain and receive one of the following error messages:
18+
19+
- > Can't join this domain. Contact your IT admin for more info.
20+
21+
- > The following error occurred attempting to join the domain "adatum.com":
22+
>
23+
> The request is not supported.
24+
25+
When you check the **NetSetup.log** file, you see the following entries:
26+
27+
```output
28+
NetpDsGetDcName: failed to find a DC having account 'CLIENT101$': 0x525, last error is 0x0
29+
NetpDsGetDcName: status of verifying DNS A record name resolution for 'AdatumDC2.adatum.com': 0x0
30+
NetpDsGetDcName: found DC '\\AdatumDC2.adatum.com' in the specified domain
31+
NetpJoinDomainOnDs: NetpDsGetDcName returned: 0x0
32+
NetpDisableIDNEncoding: using FQDN adatum.com from dcinfo
33+
NetpDisableIDNEncoding: DnsDisableIdnEncoding(UNTILREBOOT) on 'adatum.com' succeeded
34+
NetpJoinDomainOnDs: NetpDisableIDNEncoding returned: 0x0
35+
NetUseAdd to \\AdatumDC2.adatum.com\IPC$ returned 50
36+
NetpJoinDomainOnDs: status of connecting to dc '\\AdatumDC2.adatum.com': 0x32
37+
NetpJoinDomainOnDs: Function exits with status of: 0x32
38+
NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on 'adatum.com' returned 0x0
39+
NetpJoinDomainOnDs: NetpResetIDNEncoding on 'adatum.com': 0x0
40+
NetpDoDomainJoin: status: 0x32
41+
```
42+
43+
Here's more information about the error code:
44+
45+
|Hexadecimal error |Decimal error |Symbolic error string |Error description |
46+
|---------|---------|---------|---------|
47+
|0x32 |50 |ERROR_NOT_SUPPORTED |The request is not supported. |
48+
49+
## The security policy is set incorrectly
50+
51+
The **NetSetup.log** file shows that the client can't establish an SMB session with the DC. In the network trace, the SMB SESSION SETUP response has an error `NT Status: System – Error. Code = (187) STATUS_NOT_SUPPORTED`. It indicates that the DC returns `STATUS_NOT_SUPPORTED` to the C SESSION SETUP request from the client. The DC rejects the client's credentials in the C SESSION SETUP request, which is the initial step of NT LAN Manager (NTLM) authentication.
52+
53+
```output
54+
192.168.100.13 192.168.100.10 TCP TCP:Flags=......S., SrcPort=56384, DstPort=Microsoft-DS(445), PayloadLen=0, Seq=4103153181, Ack=0, Win=65535
55+
192.168.100.10 192.168.100.13 TCP TCP:Flags=...A..S., SrcPort=Microsoft-DS(445), DstPort=56384, PayloadLen=0, Seq=74752361, Ack=4103153182, Win=65535
56+
192.168.100.13 192.168.100.10 TCP TCP:Flags=...A...., SrcPort=56384, DstPort=Microsoft-DS(445), PayloadLen=0, Seq=4103153182, Ack=74752362, Win=255
57+
192.168.100.13 192.168.100.10 SMB SMB:C; Negotiate, Dialect = NT LM 0.12, SMB 2.002, SMB 2.???
58+
192.168.100.10 192.168.100.13 SMB2 SMB2:R NEGOTIATE (0x0), GUID={<GUID>}
59+
192.168.100.13 192.168.100.10 SMB2 SMB2:C NEGOTIATE (0x0), GUID={<GUID>}
60+
192.168.100.10 192.168.100.13 SMB2 SMB2:R NEGOTIATE (0x0), GUID={<GUID>}
61+
192.168.100.13 192.168.100.10 SMB2 SMB2:C SESSION SETUP (0x1)
62+
192.168.100.10 192.168.100.13 SMB2 SMB2:R - NT Status: System - Error, Code = (187) STATUS_NOT_SUPPORTED SESSION SETUP (0x1)
63+
192.168.100.13 192.168.100.10 TCP TCP:Flags=...A.R.., SrcPort=56384, DstPort=Microsoft-DS(445), PayloadLen=0, Seq=4103153717, Ack=74753066, Win=0
64+
```
65+
66+
If you establish an SMB session to the DC from a workstation in the domain, it succeeds by using the hostname and fails by using the IP. For example:
67+
68+
```console
69+
C:\users\administrator.adatum>net use \\192.168.2.254\ipc$
70+
System error 53 has occurred.
71+
72+
The network path was not found.
73+
74+
C:\users\administrator.adatum>net use \\adatumdc2\ipc$
75+
The operation completed successfully.
76+
```
77+
78+
> [!NOTE]
79+
> You might also get error 67 when using the IP.
80+
81+
However, the network trace pattern shows the same. It seems that the DC doesn't accept NTLM authentication. Status code 0x32 occurs because the security policy **Network security: Restrict NTLM: Incoming NTLM traffic** is incorrectly set to **Deny all accounts**.
82+
83+
## Change the security policy setting
84+
85+
To resolve this error, change the security policy setting to **Allow all** and refresh the group policy on that DC.
86+
87+
## More information
88+
89+
There are seven security policies related to NTLM.
90+
91+
- For auditing purposes:
92+
93+
- **Network security: Restrict NTLM: Audit Incoming NTLM Traffic**
94+
- **Network security: Restrict NTLM: Audit NTLM authentication in this domain**
95+
96+
- For exceptions:
97+
98+
- **Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication**
99+
- **Network security: Restrict NTLM: Add server exceptions in this domain**
100+
101+
> [!NOTE]
102+
> The two exception lists are for the client and the DC, respectively. There's no exception list for the server role in NTLM authentication.
103+
104+
- To control whether NTLM is allowed or not at each of the three roles in a complete NTLM authentication process:
105+
106+
- The client, which initiates the outgoing connection using NTLM
107+
108+
**Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers**
109+
- The server, which accepts the incoming connection using NTLM
110+
111+
**Network security: Restrict NTLM: Incoming NTLM traffic**
112+
- The DC, which validates the NTLM authentication request from the server
113+
114+
**Network security: Restrict NTLM: NTLM authentication in this domain**

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,8 @@ items:
359359
href: ./active-directory/error-0xa8b-resolve-dns-fail.md
360360
- name: Netlogon service doesn't keep settings after in-place upgrade
361361
href: ./active-directory/netlogon-service-not-start-automatically.md
362+
- name: Status code 0x32 and you can't join a domain
363+
href: ./active-directory/status-code-0x32-cannot-join-domain.md
362364
- name: Support boundaries for Active Directory over NAT
363365
href: ./active-directory/support-for-active-directory-over-nat.md
364366
- name: '"The account is not authorized to login from this station" error'

0 commit comments

Comments
 (0)