Join Domain and Login over a VPN Connection

6.5K

In this guide, you will learn how to join a Windows computer to an Active Directory domain over a VPN connection. This scenario is common when working remotely without direct access to the corporate network.

Which method should you use?

• VPN before logon → best for remote users
• GUI join → standard manual setup
• PowerShell → automation / IT admins
• Workaround → only if login flow fails
• Offline join (djoin.exe) → when VPN is not available at all

Offline Domain Join with djoin.exe

On a domain-joined machine (run by administrator):

djoin /provision /domain theitbros.com /machine NewPC /savefile c:\blob.txt

On the target computer (no domain connectivity needed):

djoin /requestodj /loadfile c:\blob.txt /windowspath %SystemRoot% /localos

Join your device to AD domain via VPN

After joining a domain, Windows requires a reboot. However, without an active VPN connection, the computer cannot contact a domain controller, which prevents domain logon.

Connect to VPN Before Sign-in Windows (Recommended Method)

You can use a more elegant solution that allows you to establish a VPN connection before the user logs in to Windows, without having to switch between local and domain accounts.

Suppose you’ve configured a VPN connection under the local user. These VPN connection settings are stored in the rasphone.pbk file in the user profile folder (%userprofile%\ AppData\ Roaming\ Microsoft\ Network\ Connections\ PBK). In order to make this VPN profile available to all users of the computer, you need to copy the file containing the settings for the VPN connection to the public profile C:\ ProgramData\ Microsoft\ Network\ Connections\ PBK. This makes the VPN connection available on the Windows login screen for all users.

1. Copy the rasphone.pbk file manually by using File Explorer or with the PowerShell command:
   

   # Copy VPN profile to All Users (Common) profile
   $Source = "$Env:USERPROFILE\AppData\Roaming\Microsoft\Network\Connections\PBK\rasphone.pbk"
   $Destination = "$Env:ALLUSERSPROFILE\Microsoft\Network\Connections\PBK\rasphone.pbk"
   
   Copy-Item -Path $Source -Destination $Destination -Force

   
   

   

2. Logoff Windows;
3. On the Windows logon screen, click the Network Connections icon in the bottom right-hand corner of the screen;

   

4. Specify the user credentials to connect to the VPN server;

   

5. Your computer should establish a VPN tunnel and you should be able to log in to Windows using your domain account.
   

   

To create a public VPN connection profile that is available on the Windows logon screen, you can also use the Add-VpnConnection PowerShell cmdlet with the AllUserConnection parameter enabled.

Add-VpnConnection -Name WorkVPN -ServerAddress vpn.theitbros.com -AllUserConnection $true -SplitTunneling $true -AuthenticationMethod MSChapv2 -TunnelType Automatic -EncryptionLevel Required -PassThru

How to Join a Windows Computer to a Domain over VPN

Log in to your computer using a local account with administrative privileges.

Create a new Virtual Private Network connection to your corporate VPN gateway.

1. Open the “Windows Settings” → “Network & Internet”;
2. Choose the “VPN” tab and click on “Add a VPN connection”;
   

   

3. Fill in the fields as follows:
   VPN Provider: Windows (built-in)
   Connection name: any name
   Server name or address: VPN server FQDN or IP
   VPN type: Automatic
   Sign-in info: Username and password
   

   

4. Click on “Save” button.
5. Connect to your VPN gateway.

Join your computer to the AD domain

Important. Before you will try to join the domain, you must ensure that your machine can resolve the domain name through the VPN tunnel. In case your machine uses your home router’s DNS instead of the corporate one, the join process will fail.

1. Run Command Prompt.
2. Type the command and press Enter:
   

   nslookup yourdomain.com

   (Replace “yourdomain” with your actual AD domain name).

Now you need to check the result:

• If you see the IP address of your Domain Controller, proceed to the next step.
• If you get a “Non-existent domain” error, you need to manually go to your VPN adapter settings and set the corporate DNS server IP address in the IPv4 properties.

1. Open the System Properties dialog by running the sysdm.cpl command;
2. Click on the “Change” button on the “Computer Name” tab;
   

   

3. Select the option “Domain”, type your AD domain name, and press OK;
   

   

4. Enter the credentials of the user who is allowed to join the computer to the domain;
5. Restart the computer.

Join Domain Using PowerShell (optional)

Also, you can join your Windows device to Active Directory domain using PowerShell. You can use PowerShell console when automating domain join or deploying multiple machines:

$credential = Get-Credential
Add-Computer -DomainName "theitbros.com" `
-Credential $credential `
-Restart `
-Verbose

1. Log in with local administrator credentials;
2. Connect to the VPN again.
3. Now add the domain user you will be using to the local administrator’s group on the computer. You can add a domain user account to the local group by its SID.

Note. We recommend you to use the SID method only if the domain name cannot be resolved at this point.

Ask your colleagues to find your domain account SID by using the following PowerShell command:

Get-Aduser M.Becker|select sid

You can now use PowerShell to add this account by its SID to the local Administrators group:

Add-LocalGroupMember -Group administrators -Member S-1-5-21-2927053466-1818515551-2824591131-4101

Then press CTRL+ALT+DEL and select the “Switch user” option. This allows you to log in with your domain account while keeping the VPN session active.

Enter your domain user credentials (use the following format of the username: domain\username) and login to a computer.

You are now logged in with your domain account on a domain-joined machine.

After you sign in for the first time, your domain user credentials are cached locally and you can sign in with your domain account even if the VPN is not connected.

Hint. If the Switch User option is missing, check the local GPO option Hide Entry Points for Fast User Switching under the following section: Computer configuration > Administrative Templates > System > Logon.

Summary

The most reliable method is to configure VPN before Windows logon. Other methods depend on your environment and access level.