Domain Join Sanity Checks

In order to join a Windows Server to a domain, you may need to request that the network team open certain firewall rules. The network requirements for this process can be complex and may vary depending on your specific environment.

After joining a domain, especially in a new environment, it is important to perform some checks to ensure everything is working correctly. These checks may include using GPResult and GPUpdate to update and verify Computer and User Policies, using Nltest to perform network administrative tasks such as querying domain controllers and trust relationships, and reviewing the Windows Event Viewer for any issues.

This post shows examples of performing such checks post joining a Domain for a Windows Server:
> GPResult / GPUpdate
> Nltest
> Windows Event Viewer

GPUpdate / GPResult

After joining a Windows Server to a domain, you can use the gpupdate command to check if the domain join is healthy. This command updates Computer and User Policies on the server, and can help to ensure that the server is properly configured and communicating with the domain controller.

Here is an example of running gpupdate:

We can also have a look at applied Computer policies using the /v parameter when running gpresult.

Nltest

Nltest.exe is a command-line tool that allows you to perform network administrative tasks, including querying and testing the status of domain controllers and trust relationships. Some examples of the tasks that you can perform with Nltest include:

nltest /dclist:<domain> lists all the domain controllers in the domain.

nltest /dsgetdc:<domain> queries DNS and returns a list of domain controllers (with IPs).

nltest /dsgetsite returns the site name of the domain controller.

nltest /sc_query:<domain> reports the state of the secure channel for when it was last used.

Windows Event Viewer

The Windows Event Viewer is a useful tool for viewing and managing events that are recorded by Windows operating systems. While not all events recorded in the Event Viewer require investigation, it is important to pay attention to errors and critical events, especially during the domain join process.