How to Add a Computer to a Domain Using PowerShell

Adding a Computer to a Domain with PowerShell

Joining a machine to a domain is a routine administrative task, and PowerShell provides a reliable, scriptable way to do it. The primary cmdlet is Add-Computer, which handles the domain-join operation, optionally restarts the computer, and can even remove a machine from a domain. Running the command requires local administrative rights on the target machine and appropriate permissions in Active Directory.

Prerequisites Before You Run the Command

Before attempting to add a computer to a domain, confirm several conditions are met. The target machine must be running a supported Windows edition; Windows client editions like Pro or Enterprise can join domains, but Home editions cannot. DNS resolution to the domain controller must work, and the account running the command needs permission to create computer objects in the target Organizational Unit. Verify network connectivity to a domain controller and that the machine has a valid IP configuration.

Basic Syntax of Add-Computer

The simplest form of the command joins the local computer to a specified domain and restarts it automatically. The core parameter is -DomainName, followed by the fully qualified domain name. You can optionally supply credentials with -Credential and control the restart behavior with -Restart. The -PassThru switch returns a result object so you can confirm the operation succeeded without checking the system manually.

Add-Computer -DomainName "example.com" -Restart -Credential (Get-Credential)

Specifying an Organizational Unit

By default, the new computer account lands in the default Computers container. If your environment uses targeted OUs for organizational or Group Policy reasons, use the -OUPath parameter to place the object precisely. The value must be a valid LDAP path. This is especially useful in larger deployments where you want to apply specific policies or keep the AD structure clean.

Add-Computer -DomainName "example.com" -OUPath "OU=Workstations,DC=example,DC=com" -Restart

Removing a Computer from a Domain

The same cmdlet can unjoin a computer from a domain by using the -UnjoinDomainCredential parameter. You must provide credentials for an account that has permission to remove objects in the domain. After the unjoin operation completes, the machine is no longer domain-joined and may need to be rejoined or configured as a workgroup member.

Add-Computer -UnjoinDomainCredential (Get-Credential) -Restart

Handling the Restart and PassThru Output

The -Restart parameter triggers an immediate reboot, which is necessary for the domain membership change to take effect during the next boot. If you need to perform additional steps before a restart, omit the parameter and restart manually or through your own scheduling logic. Using -PassThru is helpful in scripts where you want to capture the computer object or status message for logging purposes.

Common Errors and Troubleshooting

Several issues commonly arise when adding a computer to a domain. A frequent cause is a DNS misconfiguration that prevents the machine from locating the domain controller. Another is insufficient permissions for the account being used, which results in an access-denied error at the Active Directory level. If the command fails with a trust relationship error, it typically means the machine's secure channel to the domain is broken and needs to be reset before rejoining.

• Verify DNS settings point to a domain controller.
• Confirm the executing user has rights to add computer objects.
• Check the target OU path for correct LDAP syntax.
• Ensure the machine name does not already exist in the domain.
• Reset the secure channel with Test-ComputerSecureChannel if a prior trust failed.

When to Use PowerShell Instead of the GUI

The graphical method of joining a domain through System Properties works well for one-off manual tasks, but PowerShell excels when you need to repeat the process across multiple machines or integrate it into a larger deployment script. You can read a list of target computers from a file or inventory system and loop the Add-Computer command, providing consistent results and a clear audit trail. The cmdlet also integrates cleanly with remoting, so you can run the join operation against a machine that is online but does not have a local administrator logged in.