This is a weird issue. We had a Windows 10 PC unable to connect to the domain profile correctly, so we took it off the domain and attempted to re-add it. However, when attempting to rejoin the domain, we were greeted with the following error:
An Active Directory Domain Controller (AD DC) for the domain "MYDOMAIN" could not be contacted. Ensure that the domain name is typed correctly. If the name is correct, click Details for troubleshooting information. The domain name "MYDOMAIN" might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS. If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration. The following error occurred when DNS was queried for the service location (SRV) resource record used to location an Active Directory Domain Controller (AD DC) for domain "MYDOMAIN". The error was: "DNS name does not exist." (error code 0x0000233B RCODE_NAME_ERROR) The query was for the SRV record for _ldap._tcp.dc._msdcs.MYDOMAIN Common causes of this error include the following: - The DNS SRV records required to locate a AC DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set interfvals. This comoputer is configured to use DNS servers witht he following IP addresses: 192.168.1.xx1 192.168.1.xx2 - One or more of the following zones do not include delegation to its child zone: MYDOMAIN (the root zone)
The thing is, this isn't a single label domain. The domain is actually of the form local.mydomain.net, and when joining the domain we were doing so using the full DNS name, and initially it responded with the successful message:An account for this computer has been found in the domain "MYDOMAIN". Would you like to use this? If we click 'Yes', we receive the above error. However, if we click 'No', we can proceed to create a new registration, where we can specify the full domain name. If we use the single label domain at any point, we receive the above error again. However, if we ensure all Domain fields contain the full domain name, we are able to successfully join the domain.
The single label only appears as 'MYDOMAIN' in the 'Domain name (pre-Windows 2000)' field in the domain properties in Active Directory Domains and Trusts. This domain was created on Windows Server 2012R2 servers and has a Server 2012R2 functional level. It doesn't have a WINS server currently (although apparently it's not a bad idea to continue to run one just to stop unnecessary broadcast traffic, so we might set it up just for that).
It appears to us that this is new behaviour enforced by Microsoft, perhaps to ensure domains move away from legacy single label configurations. If that's the case, why isn't the behaviour from the domain join procedure to respond to the user that the computer name was found on the full domain name, instead of using the single label name?
Should we remove the 'pre-Windows 2000' single label name in the domain properties? Would this improve functionality?
Thanks,
Trevor