Table of Contents

Domain Join - Windows

This guide walks you through joining a Windows machine to an Active Directory domain. Once joined, Windows handles Kerberos authentication automatically, which is required for connecting Semantic Modeler to an on-premises SSAS instance.

Note

Windows Pro, Enterprise, or Education is required. Windows Home edition does not support domain join.

Prerequisites

  • Your machine can reach the AD domain controller (DNS resolution and network connectivity)
  • You have an AD account with permission to join machines to the domain
  • You have a local administrator account on the Windows machine

Option A: Settings (Windows 10/11)

Step 1: Open Domain Join Settings

  1. Open Settings (Win + I)
  2. Go to Accounts > Access work or school
  3. Click Connect
  4. At the bottom of the dialog, click Join this device to a local Active Directory domain

Step 2: Enter the Domain

  1. Type your domain name (e.g., yourdomain.com)
  2. Click Next

Step 3: Authenticate

  1. Enter credentials for an AD account with permission to join machines
  2. Click OK

Step 4: Set Up the User Account

  1. Windows asks you to add a domain account and set its role (Standard User or Administrator)
  2. Fill this in or skip it - you can manage this later
  3. Click Next

Step 5: Restart

Click Restart Now. After the restart, you can log in with your AD credentials at the Windows login screen.

Option B: System Properties (All Windows Versions)

Step 1: Open System Properties

Press Win + R, type sysdm.cpl, and press Enter.

Or: right-click This PC > Properties > Advanced system settings (on the right or at the bottom).

Step 2: Change the Domain

  1. Click the Computer Name tab
  2. Click Change
  3. Under Member of, select Domain
  4. Enter your domain name (e.g., yourdomain.com)
  5. Click OK

Step 3: Authenticate

  1. Enter credentials for an AD account with permission to join machines
  2. Click OK
  3. You should see a "Welcome to the yourdomain.com domain" message

Step 4: Restart

Click OK and restart the machine. After the restart, you can log in with your AD credentials.

Option C: PowerShell

Open PowerShell as Administrator and run:

Add-Computer -DomainName "yourdomain.com" -Credential (Get-Credential) -Restart

A credentials dialog appears. Enter the AD account and password, and the machine will join and restart automatically.

To specify an OU for the computer account:

Add-Computer -DomainName "yourdomain.com" `
    -OUPath "OU=Workstations,DC=yourdomain,DC=com" `
    -Credential (Get-Credential) -Restart

Verifying the Join

After restarting:

  1. Press Win + R, type dsregcmd /status, and press Enter
  2. Under Device State, look for DomainJoined : YES

Or in PowerShell:

(Get-WmiObject Win32_ComputerSystem).PartOfDomain

This should return True.

Using Kerberos After Joining

Once domain-joined and logged in with your AD credentials, Windows obtains Kerberos tickets automatically. No manual steps are needed - Semantic Modeler can connect to your SSAS instance using your Windows credentials.

To verify you have a Kerberos ticket, open Command Prompt and run:

klist

You should see a ticket for krbtgt/YOURDOMAIN.COM.

Leaving the Domain

Settings

  1. Go to Settings > Accounts > Access work or school
  2. Click your domain connection
  3. Click Disconnect
  4. Confirm and restart

PowerShell

Remove-Computer -Credential (Get-Credential) -Restart

Troubleshooting

"The specified domain either does not exist or could not be contacted": DNS can't resolve the domain. Make sure your DNS server is set to the AD domain controller. Check in Settings > Network & Internet > your adapter > DNS server assignment, or in PowerShell:

# View current DNS
Get-DnsClientServerAddress

# Set DNS to your domain controller
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses "10.0.0.1"

"Access is denied" or "Insufficient permissions": The AD account you're using doesn't have permission to join machines. Ask your AD admin to grant join privileges or pre-stage the computer account.

"The machine account quota has been exceeded": By default, AD allows each user to join up to 10 machines. Ask your AD admin to increase the quota or pre-stage the computer account.

Can't log in with AD credentials after restart: At the login screen, click Other user and enter your credentials as YOURDOMAIN\username or [email protected]. Make sure the machine can reach the domain controller over the network.

Edit this page