If you attempt to join a computer to an AD domain during reimaging (by specifying the domain in an Answer File), or via the Join a Domain command in Computer Management, and the computer does not successfully join the domain, you'll need to check the log located on the endpoint in:
C:\Windows\Debug\Netsetup.log
In this log, you should see any domain join activity that has been attempted on this computer, as well as the outcome of each attempt.
One common error message when attempting to join a domain with an OU specified is "Cannot retry downlevel, specifying OU is not supported".
Keep in mind these troubleshooting tips:
- The downlevel error message most commonly occurs because an incorrect or invalid organizational unit (OU) was specified in the Domain Join section of the answer file. OU is an optional setting, so if you receive the error message above, go ahead and retry the domain join operation without specifying an OU. If the operation succeeds, then the problem was likely with the OU you specified. If the operation still fails, then the log may contain some other issue, such as a permissions issue with the domain user account you specified, or that user has exceeded the maximum number of domain joins.
- If you wish to specify an OU, you must specify it in the Distinguished Name format.
- If you wish to specify an OU, you cannot specify the default Computers group - this is a container and not an OU, and it is where computers will end up by default if you do not specify an OU on an AD domain with the default configuration. Specifying the Computers container as an OU is not supported and will cause the domain join to fail.
