How to Add a Computer to an Active Directory Domain using PowerShell

Automating Domain Joins

When deploying a new fleet of Windows workstations or spinning up fresh Windows Server virtual machines, joining them to the corporate Active Directory (AD) domain is a mandatory step. Traditionally, system administrators accomplish this by opening the System Properties GUI, clicking “Change settings,” typing the domain name, and entering credentials.

However, if you are writing an automated provisioning script (using tools like Terraform, Ansible, or simple PowerShell startup scripts), you must bypass the GUI entirely. The Add-Computer cmdlet in PowerShell allows you to join a machine to a domain silently, efficiently, and scriptably.

Step 1: The Basic Command

To join a computer to an Active Directory domain named corp.contoso.com, open an elevated PowerShell prompt (Run as Administrator) and execute the following command:

Add-Computer -DomainName "corp.contoso.com"

Because joining a domain requires authorization from an Active Directory account with “Add Workstations to Domain” privileges, PowerShell will immediately halt and present a graphical pop-up window asking for a username and password.

Step 2: Suppressing the Credential Prompt

If you are running an automated script in the background, a graphical pop-up will cause the script to hang indefinitely. You must pass the credentials directly into the command.

First, create a credential object using the Get-Credential cmdlet (or securely retrieve it from a vault like Azure Key Vault if doing this at scale):

$Creds = Get-Credential "corp\AdminUser"

Then, append the -Credential parameter to your join command:

Add-Computer -DomainName "corp.contoso.com" -Credential $Creds

The command will now execute completely silently.

Step 3: Forcing a Restart

Changing a computer’s domain membership modifies core Security Identifiers (SIDs) and requires a full system reboot before the new AD policies (like Group Policy Objects) can be applied or domain users can log in.

You can force the Add-Computer cmdlet to automatically reboot the machine the instant the domain join is successful by appending the -Restart flag.

Add-Computer -DomainName "corp.contoso.com" -Credential $Creds -Restart -Force

The -Force parameter is often necessary here to guarantee the restart occurs even if other users are currently logged into the machine.

Troubleshooting DNS Issues

If the command fails instantly with a red error stating the domain controller could not be contacted, the machine is likely using the wrong DNS server. A computer can only join a domain if it can successfully resolve the corp.contoso.com address.

Ensure that your DHCP server is handing out the IP address of your internal Domain Controller as the primary DNS server, rather than a public DNS server like 8.8.8.8.