Resolving “JoinDomain” Errors When Deploying Windows Virtual Desktop Host Pool in Azure

When creating a Windows Virtual Desktop (WVD) Host Pool in Azure, you may receive an error while attempting to complete the Join Domain Operations.

The message you receive will look like the following:

The verbatim of the raw error log will read:

"VM has reported a failure when processing extension 'joindomain'. Error message: \\\"Exception(s) occurred while joining Domain ''."

Several customers who have received this error on countless occasions haven’t understood why it was happening and ultimately prolonged their production deployment of WVD in Azure. If you are already familiar with the steps to set up a WVD Host Pool, but seek to uncover how to resolve your failed deployment, follow along to uncover when and why you receive this error and the steps to recovery.

“JoinDomain” Errors - When and Why They Happen

If you are following the Microsoft documentation to create a host pool by using the Azure Marketplace, you will complete a wizard in the Azure portal after picking the following item in the Azure Marketplace:

On the third screen of that wizard (Virtual Machine Settings), you will provide an account that has permissions to join the Active Directory domain you will be using for your WVD environment. This account is specified in the field labeled “AD domain join UPN.” Optionally, you may also “specify domain or OU” if you would like to join the virtual machines to a specific domain. Otherwise, by selecting “No,” the virtual machines will not be joined to a different domain, and the suffix of the “AD domain join UPN”' will be used as the domain name.

The final important fields on this screen concern configuring the virtual network (VNet) that your virtual desktops will be connected (Virtual Network and vmSubnet). Reviewing and understanding all of these fields can assist you in troubleshooting this issue.

The error is showing that the deployment is having issues joining the created virtual machines to the domain you have specified in the “AD domain join UPN” field or (if used) the “Domain to join” field. The cause of this would be much like the cause of not being able to join a computer to an on-premises domain. It will more than likely be related to network connectivity or DNS resolution. More times than not, it is related to not specifying the correct DNS servers on the Azure VNet.

It is crucial to ensure that the subnet that you are specifying here has full network connectivity to the same network as the Domain Controllers or Azure AD Domain Services. Also, if you use a new VNet created at the time of deployment, it will not have the access needed to the domain controller by default.

Conversely, if you deploy to an existing VNet on the same subnet, or even to a new subnet in the same VNet, this should work unless there were security settings blocking connectivity between the subnets. You can use normal network troubleshooting techniques to determine if there are routing and port blocking issues, but the name resolution problems may be difficult to find if you are new to Azure.

How To Fix Your DNS Resolution

After you create a virtual network in Azure, you can specify which DNS servers the virtual machines on that network can use for name resolution. By default, it will use “Default (Azure-provided).”

Whether they exist in an Azure Virtual Network or on-premises across a Virtual Private Network (VPN) Connection, this option will not find DNS servers you have set up for domain authentication. Therefore, you must specify a custom DNS server address so that name resolution to the domain you are attempting to join can successfully resolve.

After specifying the correct DNS servers in this step and verifying that there are no routing or port blocking issues between this subnet and the domain controllers, you will be able to deploy a Windows Virtual Desktop Host Pool in Azure successfully.