Unable to join VM to AD - cannot complete this function

Question

I am having a VMs in Azure and AD VM also in Azure. They are all in same network, although in different subnets.

I have provisioned the VM's by terraform and they are unable to join to AD, hence I am doing manually to see what the error is.

Commands to connect VM to AD is below:

PS C:\Users\scmadmin> $domain = "contoso.com"
PS C:\Users\scmadmin> $password = "<password here>" | ConvertTo-SecureString -asPlainText -Force
PS C:\Users\scmadmin> $username = "$domain\scmadmin"
PS C:\Users\scmadmin> $credential = New-Object System.Management.Automation.PSCredential($username,$password)
PS C:\Users\scmadmin> Add-Computer -DomainName $domain -Credential $credential

The log output after the execution is below:

Add-Computer : Computer 'erxprebussvc01' failed to join domain 'contoso.com' from its current workgroup 'WORKGROUP'
with following error message: Cannot complete this function.
At line:1 char:1
+ Add-Computer -DomainName $domain -Credential $credential
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (erxprebussvc01:String) [Add-Computer], InvalidOperationException
    + FullyQualifiedErrorId : FailToJoinDomainFromWorkgroup,Microsoft.PowerShell.Commands.AddComputerCommand

At Virtual Network level, DNS Server IP is the IP (Private IP) of AD=10.112.1.4

I am able to ping domain,

PS C:\Users\scmadmin> ping contoso.com

Pinging contoso.com [10.112.1.4] with 32 bytes of data:
Reply from 10.112.1.4: bytes=32 time=1ms TTL=128
Reply from 10.112.1.4: bytes=32 time=1ms TTL=128
Reply from 10.112.1.4: bytes=32 time=1ms TTL=128
Reply from 10.112.1.4: bytes=32 time=1ms TTL=128

Ping statistics for 10.112.1.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

Windows Event viewer log reports the below error

The machine erxprebussvc01 attempted to join the domain contoso.com but failed. The error code was 1355.

Unable to understand what is the issue/how to troubleshoot and how to resolve it.

From the client Vm, can you do a ipconfig/all and check if you can see the AD's IP as the DNS server? — msrini-MSIT, Jun 03 '19 at 14:57
I have done exactly what you wrote. DNS records are also correct. I am investigating it further, when I get a right lead, I shall update everyone here. — learner, Jun 05 '19 at 08:03
Have you tried to manually join the domain in the UI? Does it pop out the box of providing credentials? — Nancy, Jun 05 '19 at 09:58
Yes manually via UI and command line I get the same error. Cannot complete this function, something on these lines... — learner, Jun 05 '19 at 10:32
After you change the DNS servers for the VNet, Have you reboot both your VMs on the portal? — Nancy, Jun 06 '19 at 09:53
It's strange, you can reproduce this issue 100%? or is there any difference setting between you deploy VM via terraform and manually UI? — Nancy, Jun 10 '19 at 01:50

score 1 · Accepted Answer · answered Jun 04 '19 at 07:50

I have not provisioned the VMs by terraform. Instead, I manually deploy two Azure VMs (one is as AD and DNS server, the other is as Client) on the Azure portal. The steps are simple as below:

Deploy both VMs in a different subnet but in the same VNet.
Set Up server role(ADDC, DNS) on the AD server and make it as the DC server.
Change the DNS servers to the AD private IP address in the Azure VNet portal.
Restart two Azure VMs on the Azure portal.
After VM restoring running, RDP to the client VM, you can join this VM to AD domain contoso.com manually or via commands.

Generally, VMs in the same subnet could communicate with each other without any port limitation. So It looks like the DNS issue on your side. You can reboot your VMs or ipconfig/flushdns on the client VM. Or verify if the DNS records are created on the DC VM properly.

Moreover, you can refer to this event error code 1355 and this troubleshooting tutorial: How to troubleshoot errors that occur when you join Windows-based computers to a domain

Unable to join VM to AD - cannot complete this function

1 Answers1