Skip to content

Commit f13c8f4

Browse files
Deland-HanDeland-Han
authored
Merge pull request #8693 from Deland-Han/ci5170-part
Ci5170 part
2 parents 539b2ce + 5ebe727 commit f13c8f4

File tree

4 files changed

+195
-55
lines changed

4 files changed

+195
-55
lines changed

‎support/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance.md‎

Lines changed: 1 addition & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -55,27 +55,6 @@ The following table lists the ports required to be open between the client compu
5555

5656
For more information, see [Error code 0x569: The user has not been granted the requested logon type at this computer](error-0x569-not-granted-logon-type.md).
5757

58-
### Error code 0x534
59-
60-
> No mapping between account names and security IDs was done.
61-
62-
Here's an example from the *netsetup.log* file:
63-
64-
```output
65-
mm/dd/yyyy hh:mm:ss:ms NetpCreateComputerObjectInDs: NetpGetComputerObjectDn failed: 0x534
66-
mm/dd/yyyy hh:mm:ss:ms NetpProvisionComputerAccount: LDAP creation failed: 0x534
67-
mm/dd/yyyy hh:mm:ss:ms ldap_unbind status: 0x0
68-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: Function exits with status of: 0x534
69-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomainOnDs: status of disconnecting from '\\<DC name>': 0x0
70-
mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x534
71-
```
72-
73-
The domain join graphical user interface (GUI) can call the `NetJoinDomain` API twice to join a computer to a domain. The first call is made without the "create" flag being specified to locate a pre-created computer account in the target domain. If no account is found, a second `NetJoinDomain` API call may be made with the "create" flag specified.
74-
75-
In another scenario, the 0x534 error code is logged when you attempt to change the password for a machine account. However, the account can't be found on the targeted DC, likely because the account was not created or due to replication latency or a replication failure.
76-
77-
The 0x534 error code is commonly logged as a transient error when domain join searches the target domain. The search determines whether a matching computer account was pre-created or the join operation needs to dynamically create a computer account on the target domain. Check the bit flags in the join options to see if the type of join being performed is relying on a pre-created or newly created computer account.
78-
7958
### Error code 0x6BF or 0xC002001C
8059

8160
> The remote procedure call failed and did not execute.
@@ -100,40 +79,7 @@ Make sure of the following items:
10079

10180
### Error code 0x6D9
10281

103-
> There are no more endpoints available from the endpoint mapper.
104-
105-
Here's an example from the *netsetup.log* file:
106-
107-
```output
108-
mm/dd/yyyy hh:mm:ss:ms NetpGetDnsHostName: Read NV Hostname: <hostname>
109-
mm/dd/yyyy hh:mm:ss:ms NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: <DNS domain>.<TLD>
110-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0xc0000034
111-
mm/dd/yyyy hh:mm:ss:ms NetpGetLsaPrimaryDomain: status: 0x0
112-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0xc0000034
113-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: NetUserAdd on \\<hostname>.<domain> for <computername>$ failed: 0x8b0
114-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: status of attempting to set password on \\<DC name>.<domain>.<tld> for <hostname>$: 0x0
115-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of creating account: 0x0
116-
mm/dd/yyyy hh:mm:ss:ms NetpGetComputerObjectDn: Unable to bind to DS on \\<DC name>.<domain>.<tld>: 0x6d9
117-
mm/dd/yyyy hh:mm:ss:ms NetpSetDnsHostNameAndSpn: NetpGetComputerObjectDn failed: 0x6d9
118-
mm/dd/yyyy hh:mm:ss:ms ldap_unbind status: 0x0
119-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of setting DnsHostName and SPN: 0x6d9
120-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: initiaing a rollback due to earlier errors
121-
mm/dd/yyyy hh:mm:ss:ms NetpGetLsaPrimaryDomain: status: 0x0
122-
mm/dd/yyyy hh:mm:ss:ms NetpManageMachineAccountWithSid: status of disabling account <hostname>$ on \\<DC name>.<domain>.<tld>: 0x0
123-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: rollback: status of deleting computer account: 0x0
124-
mm/dd/yyyy hh:mm:ss:ms NetpLsaOpenSecret: status: 0x0
125-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: rollback: status of deleting secret: 0x0
126-
mm/dd/yyyy hh:mm:ss:ms NetpJoinDomain: status of disconnecting from \\<DC name>.<domain>.<tld>: 0x0
127-
mm/dd/yyyy hh:mm:ss:ms NetpDoDomainJoin: status: 0x6d9
128-
```
129-
130-
Error 0x6D9 is logged when network connectivity is blocked between the joining client and the helper DC. The network connectivity services the domain join operation over port 135 or a port in the ephemeral range between 1025 to 5000 or 49152 to 65535. For more information, see [Service overview and network port requirements for Windows](../networking/service-overview-and-network-port-requirements.md).
131-
132-
To resolve this error, follow these steps:
133-
134-
1. On the joining client, open the *%systemroot%\\debug\\NETSETUP.LOG* file and determine the name of the helper DC selected by the joining client to perform the join operation.
135-
2. Verify that the joining client has network connectivity to the DC over the required ports and protocols used by the applicable operating system (OS) versions. Domain join clients connect a helper DC over TCP port 135 by the dynamically assigned port in the range between 49152 and 65535.
136-
3. Ensure that the OS, software and hardware routers, firewalls, and switches allow connectivity over the required ports and protocols.
82+
See [Domain join error 0x6D9 "There are no more endpoints available from the endpoint mapper"](./domain-join-error-0x6d9-there-are-no-more-endpoints-available-from-the-endpoint-mapper.md) for troubleshooting guide.
13783

13884
### Error code 0xa8b
13985

‎support/windows-server/active-directory/domain-join-error-0x6d9-there-are-no-more-endpoints-available-from-the-endpoint-mapper.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
title: Error 0x6D9 There Are No More Endpoints Available from the Endpoint Mapper
3+
description: Addresses the error There are no more endpoints available from the endpoint mapper encountered during domain join operations.
4+
ms.date: 03/28/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: raviks, eriw, dennhu
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Domain join error 0x6D9 "There are no more endpoints available from the endpoint mapper"
14+
15+
This article addresses the error code 0x6D9 encountered during domain join operations.
16+
17+
## Symptoms
18+
19+
When you try to join a computer to a domain, you receive the following error message:
20+
21+
> There are no more endpoints available from the endpoint mapper.
22+
23+
When you review the **netsetup.log** file, you find error messages that resemble the following entries:
24+
25+
```output
26+
NetpGetDnsHostName: Read NV Hostname: <hostname>
27+
NetpGetDnsHostName: PrimaryDnsSuffix defaulted to DNS domain name: <DNS domain>.<TLD>
28+
NetpLsaOpenSecret: status: 0xc0000034
29+
NetpGetLsaPrimaryDomain: status: 0x0
30+
NetpLsaOpenSecret: status: 0xc0000034
31+
NetpManageMachineAccountWithSid: NetUserAdd on \\<hostname>.<domain> for <computername>$ failed: 0x8b0
32+
NetpManageMachineAccountWithSid: status of attempting to set password on \\<DC_name>.<domain>.<tld> for <hostname>$: 0x0
33+
NetpJoinDomain: status of creating account: 0x0
34+
NetpGetComputerObjectDn: Unable to bind to DS on \\<DC_name>.<domain>.<tld>: 0x6d9
35+
NetpSetDnsHostNameAndSpn: NetpGetComputerObjectDn failed: 0x6d9
36+
ldap_unbind status: 0x0
37+
NetpJoinDomain: status of setting DnsHostName and SPN: 0x6d9
38+
NetpJoinDomain: initiaing a rollback due to earlier errors
39+
NetpGetLsaPrimaryDomain: status: 0x0
40+
NetpManageMachineAccountWithSid: status of disabling account <hostname>$ on \\<DC_name>.<domain>.<tld>: 0x0
41+
NetpJoinDomain: rollback: status of deleting computer account: 0x0
42+
NetpLsaOpenSecret: status: 0x0
43+
NetpJoinDomain: rollback: status of deleting secret: 0x0
44+
NetpJoinDomain: status of disconnecting from \\<DC_name>.<domain>.<tld>: 0x0
45+
NetpDoDomainJoin: status: 0x6d9
46+
```
47+
48+
### Error detail
49+
50+
| Hexadecimal error | Decimal error | Symbolic error string | Friendly error |
51+
| --------- | ------------- | --------------------- | --------------------------------------------------------------- |
52+
| 0x6d9 | 1753 | EPT_S_NOT_REGISTERED | There are no more endpoints available from the endpoint mapper. |
53+
54+
## Cause
55+
56+
Error 0x6D9 is logged when network connectivity is blocked between the joining client and the Domain Controller (DC). The network connectivity services the domain join operation initially over Transmission Control Protocol (TCP) port 135, and then an ephemeral port which is by default between 49152 to 65535. For more information, see [How to restrict Active Directory RPC traffic to a specific port](restrict-ad-rpc-traffic-to-specific-port.md).
57+
58+
The network connectivity issue can be caused by several factors, including advanced security solutions with host firewalls installed on the DC, port exhaustion, and other potential issues.
59+
60+
## Resolution
61+
62+
1. On the joining client, open the **%systemroot%\\debug\\NETSETUP.LOG** file and determine the name of the DC selected by the joining client to perform the join operation. For example, the following **NETSETUP.LOG** sample shows that the joining client "APP_SRV" is using the DC "DC1.CONTOSO.COM":
63+
64+
```output
65+
NetpManageMachineAccountWithSid: NetUserAdd on '\\DC1.CONTOSO.COM' for 'APP_SRV$' failed: 0x8b0
66+
NetpManageMachineAccountWithSid: status of attempting to set password on '\\DC1.CONTOSO.COM' for '<APP_SRV>$': 0x0
67+
NetpJoinDomain: status of creating account: 0x0
68+
NetpGetComputerObjectDn: Unable to bind to DS on '\\DC1.CONTOSO.COM': 0x6d9
69+
```
70+
71+
2. Verify that the joining client has network connectivity to the DC over the required ports and protocols used by the applicable operating system (OS) versions. Domain join clients initially connect to a DC over TCP port 135, and then a dynamically assigned port in the range between 49152 and 65535.
72+
3. Ensure that the OS, software and hardware routers, firewalls, and switches allow connectivity over the required ports and protocols.
73+
4. Ensure that there are enough ports available for the operation. You can use tools like netstat to check for port availability and usage.
74+
5. If advanced security solutions with host firewalls are installed on the DC, review their settings to ensure they aren't blocking the required ports.
75+
6. Consider other potential causes and troubleshoot accordingly. For example, check firewall rules, ensure proper Domain Name System (DNS) resolution, and verify the health of the DC.
76+
77+
## Reference
78+
79+
For more information, see [Service overview and network port requirements for Windows](../networking/service-overview-and-network-port-requirements.md).

‎support/windows-server/active-directory/failure-when-you-use-an-existing-computer-account-to-join-a-domain.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Failure When You Use an Existing Computer Account to Join a Domain
3+
description: Addresses the issue of failing to join a computer to a domain when an existing computer account with the same name already exists.
4+
ms.date: 03/28/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: raviks, eriw, dennhu
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Failure when you use an existing computer account to join a domain
14+
15+
This article addresses the issue of failing to join a computer to a domain when an existing computer account with the same name already exists.
16+
17+
## Symptoms
18+
19+
When you try to use an existing computer account name to join a computer to a domain, the operation fails and you receive the following error messages:
20+
21+
In the **Access work or school** page:
22+
> Can't join this domain. Contact your IT admin for more info.
23+
24+
In **System Properties**:
25+
> The following error occurred attempting to join the domain "\<domain_name\>":
26+
>
27+
> An account with the same name exists in Active Directory.
28+
> Re-using the account was blocked by security policy.
29+
30+
### Netsetup.log
31+
32+
Review the following example of the **Netsetup.log** file on a fully updated system.
33+
34+
```output
35+
NetpProvisionComputerAccount:
36+
lpDomain: contoso.com
37+
lpHostName: host1
38+
lpMachineAccountOU: (NULL)
39+
lpDcName: ContosoDC1.contoso.com
40+
lpMachinePassword: (null)
41+
lpAccount: contoso\nonadminuser2
42+
lpPassword: (non-null)
43+
dwJoinOptions: 0x403
44+
dwOptions: 0x40000003
45+
NetpLdapBind: Verified minimum encryption strength on ContosoDC1.contoso.com: 0x0
46+
NetpLdapGetLsaPrimaryDomain: reading domain data
47+
NetpGetNCData: Reading NC data
48+
NetpGetDomainData: Lookup domain data for: DC=contoso,DC=com
49+
NetpGetDomainData: Lookup crossref data for: CN=Partitions,CN=Configuration,DC=contoso,DC=com
50+
NetpLdapGetLsaPrimaryDomain: result of retrieving domain data: 0x0
51+
NetpCheckForDomainSIDCollision: returning 0x0(0).
52+
NetpGetComputerObjectDn: Cracking DNS domain name contoso.com/ into Netbios on \\ContosoDC1.contoso.com
53+
NetpGetComputerObjectDn: Crack results: name = CONTOSO\
54+
NetpGetComputerObjectDn: Cracking account name CONTOSO\HOST1$ on \\ContosoDC1.contoso.com
55+
NetpGetComputerObjectDn: Crack results: (Account already exists) DN = CN=HOST1,CN=Computers,DC=contoso,DC=com
56+
NetpGetADObjectOwnerAttributes: Looking up attributes for machine account: CN=HOST1,CN=Computers,DC=contoso,DC=com
57+
NetpGetNCData: Reading NC data
58+
NetpReadAccountReuseModeFromAD: Searching '<WKGUID=AB1D30F3768811D1ADED00C04FD8D5CD,DC=contoso,DC=com>' for '(&(ObjectClass=ServiceConnectionPoint)(KeyWords=NetJoin*))'.
59+
NetpReadAccountReuseModeFromAD: Got 0 Entries.
60+
Returning NetStatus: 0, ADReuseMode: 0
61+
IsLegacyAccountReuseSetInRegistry: RegQueryValueEx for 'NetJoinLegacyAccountReuse' returned Status: 0x2.
62+
IsLegacyAccountReuseSetInRegistry returning: 'FALSE''.
63+
NetpDsValidateComputerAccountReuseAttempt: returning NtStatus: 0, NetStatus: 0
64+
NetpDsValidateComputerAccountReuseAttempt: returning Result: FALSE
65+
NetpCheckIfAccountShouldBeReused: Active Directory Policy check with SAM_DOMAIN_JOIN_POLICY_LEVEL_V2 returned NetStatus:0x0.
66+
NetpCheckIfAccountShouldBeReused: Account re-use attempt was Denied by Active Directory Policy.
67+
NetpCheckIfAccountShouldBeReused:fReuseAllowed: FALSE, NetStatus:0x0
68+
NetpModifyComputerObjectInDs: Account exists and re-use is blocked by policy. Error: 0xaac
69+
NetpProvisionComputerAccount: LDAP creation failed: 0xaac
70+
NetpProvisionComputerAccount: Retrying downlevel per options
71+
NetpManageMachineAccountWithSid: NetUserAdd on 'ContosoDC1.contoso.com' for 'HOST1$' failed: 0x8b0
72+
IsLegacyAccountReuseSetInRegistry: RegQueryValueEx for 'NetJoinLegacyAccountReuse' returned Status: 0x2.
73+
IsLegacyAccountReuseSetInRegistry returning: 'FALSE''.
74+
NetpManageMachineAccountWithSid: The computer account already exists in Active Directory.Re-using the account was blocked by security policy.
75+
NetpProvisionComputerAccount: retry status of creating account: 0xaac
76+
ldap_unbind status: 0x0
77+
NetpJoinCreatePackagePart: status:0xaac.
78+
NetpJoinDomainOnDs: Function exits with status of: 0xaac
79+
NetpJoinDomainOnDs: status of disconnecting from '\\ContosoDC1.contoso.com': 0x0
80+
NetpResetIDNEncoding: DnsDisableIdnEncoding(RESETALL) on 'contoso.com' returned 0x0
81+
NetpJoinDomainOnDs: NetpResetIDNEncoding on 'contoso.com': 0x0
82+
NetpDoDomainJoin: status: 0xaac
83+
```
84+
85+
### Error detail
86+
87+
|Hexadecimal error|Decimal error|Symbolic error string|Error description|Header|
88+
|---|---|---|---|---|
89+
|0x8b0|2224|NERR_UserExists|The account already exists.|lmerr.h|
90+
|0xaac|2732|NERR_AccountReuseBlockedByPolicy|An account with the same name exists in Active Directory. Re-using the account was blocked by security policy.|lmerr.h|
91+
92+
## Cause
93+
94+
Windows introduced additional protections with updates released on and after October 11, 2022. These protections intentionally prevent domain join operations from reusing an existing computer account in the target domain unless any of the following conditions is met:
95+
96+
- The user attempting the operation is the creator of the existing account.
97+
- The computer is created by a member of domain administrators, enterprise administrators, or built-in administrators groups.
98+
- The owner of the computer account object that is being reused is a member of the **Domain controller: Allow computer account reuse during domain join** Group Policy setting. This setting requires the installation of Windows updates released on or after March 14, 2023, on all member computers and domain controllers.
99+
100+
## Resolution
101+
102+
To fix the issue, follow these steps:
103+
104+
1. Perform the join operation by using the same account that created the computer account in the target domain.
105+
2. If the existing account is stale (unused), delete it before attempting to join the domain again.
106+
3. Rename the computer and join the domain using a different account that doesn't exist.
107+
4. If a trusted security principal owns the existing account, and an administrator wants to reuse the account, use the **Domain controller: Allow computer account re-use during domain join** Group Policy.
108+
109+
## Reference
110+
111+
For more information about domain join hardening changes, see [KB5020276—Netjoin: Domain join hardening changes](https://support.microsoft.com/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8).

‎support/windows-server/toc.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,10 @@ items:
349349
href: ./active-directory/cannot-connect-internet-domain.md
350350
- name: Default limit to workstation numbers
351351
href: ./active-directory/default-workstation-numbers-join-domain.md
352+
- name: 'Error 0x6D9 "No more endpoints available from the endpoint mapper"'
353+
href: ./active-directory/domain-join-error-0x6d9-there-are-no-more-endpoints-available-from-the-endpoint-mapper.md
354+
- name: Failure when you use an existing computer account to join a domain
355+
href: ./active-directory/failure-when-you-use-an-existing-computer-account-to-join-a-domain.md
352356
- name: Error 0x5 Access Denied when you rename a computer
353357
href: ./active-directory/error-0x5-access-denied-rename-computer.md
354358
- name: Error code 0x569

0 commit comments

Comments
 (0)