Prerequisites and Network Configuration
Before attempting to join any machine to the domain, the underlying infrastructure must be solid. The most common failure point is network isolation between virtual machines. In VirtualBox, ensure that your Windows Server 2019 (the Domain Controller) and your Domain VM (the target member server or workstation) are on the same virtual network. You can achieve this by setting both VMs to use "Bridged Adapter" or "NAT Network." Avoid using "Host-only" unless you have explicitly configured routing rules, as it often isolates guests from each other by default. Verify connectivity by pinging the domain controller from the client VM. Open PowerShell or Command Prompt on the client and runping [DomainControllerIP]. If the ping fails, check the virtual switch settings in the VirtualBox Manager. Ensure that the MAC addresses are not duplicated across VMs if they share the same physical network segment. For internal lab environments, a private host-only network with static IP assignments is often more stable than bridged mode, provided you configure the IP addresses manually to avoid DHCP conflicts.
For a deeper understanding of the base installation process, refer to our guide on Windows Server Installation with VirtualBox. Proper initial configuration reduces the likelihood of driver or network stack issues during the domain joining phase.
Setting Up the Active Directory Domain
The Windows Server 2019 instance must be promoted to a Domain Controller before clients can join. Log into the server, open Server Manager, and select "Add roles and features." Navigate to Active Directory Domain Services and install the role. After installation, you will see a notification banner; click the link to promote this server to a domain controller. Choose "Create a new forest" and enter your desired root domain name, such ascorp.local. During the setup, you will be prompted for a Directory Services Restore Mode (DSRM) password. Record this securely, as it is required for emergency recovery scenarios. Once the promotion completes, the server will reboot. Verify that the DNS service is running correctly, as Active Directory relies heavily on DNS SRV records for locating services. You can test this by querying the local DNS server using nslookup -type=SRV _ldap._tcp.corp.local. If the query returns no results, the AD integration is incomplete.
Configuring Client DNS Settings
This step is critical and frequently overlooked. A client computer cannot join a domain if it cannot resolve the domain's DNS name. On your Domain VM (whether it is a Windows 10 workstation or another server), navigate to Network Connections. Right-click your active adapter and select Properties. Double-click Internet Protocol Version 4 (TCP/IPv4). Change the DNS server settings to use the following options:- Preferred DNS server: Enter the IP address of your Windows Server 2019 Domain Controller.
- Alternate DNS server: Leave this blank or enter the same IP address. Do not use public DNS servers like 8.8.8.8 while testing domain joins, as they do not know about your internal AD zones.
ipconfig /flushdns. Then, attempt to ping the domain name itself (e.g., ping corp.local). If this resolves to the DC's IP, the network path is clear.
Joining the Domain
With DNS correctly configured, you can proceed to join the Domain VM to the domain. Open System Properties by right-clicking "This PC" and selecting Properties, then clicking "Advanced system settings." Go to the Computer Name tab and click "Change." Under "Member of," select "Domain" and type your domain name (e.g.,corp.local).
You will be prompted for credentials. Use an account with administrative privileges on the domain controller, typically the Administrator account created during the AD promotion. If successful, you will receive a welcome message confirming that you have joined the domain. Restart the machine immediately after the change. Upon reboot, you should be able to log in using the format CORP\Username or [email protected].
If you encounter authentication errors, verify that the time synchronization between the VMs is accurate. Kerberos, the authentication protocol used by Active Directory, is sensitive to time drift. Ensure both VMs have their time synchronized with the same source, either via the host OS or an internal NTP server.
For those interested in securing remote access to these servers once connected, see our article on Windows Server 2019: SSH Server Max Number of Connections or Concurrent Users.
Troubleshooting Common Issues
If the join operation fails, check the Event Viewer on the client machine under Applications and Services Logs > Microsoft > Windows > DirectoryServices-Client. Look for error codes related to DNS resolution or trust relationships. A common issue is the client being unable to locate the Global Catalog. Ensure that the DC has the Global Catalog role enabled, which is default for single-domain forests. Another frequent cause is firewall restrictions. While VirtualBox handles basic connectivity, Windows Firewall on the server may block necessary ports. Ensure that TCP/UDP 53 (DNS), TCP 88 (Kerberos), TCP 445 (SMB), and UDP 123 (NTP) are allowed through the firewall on the Domain Controller. If you are using a third-party antivirus or security suite, temporarily disable it to rule out interference during the join process.Frequently Asked Questions
Why does my VM fail to ping the domain controller?
This usually indicates a network isolation issue within VirtualBox. Ensure both VMs are attached to the same virtual network type, such as Bridged Adapter or NAT Network, rather than one being on Host-only and the other on NAT.
Can I join a domain without knowing the admin password?
No, you must provide credentials for an account that has permission to add computers to the domain. The built-in Administrator account is the standard choice, but any user with explicit delegation rights can also perform this action.
What happens if DNS is not set to the DC's IP?
The client will not be able to locate the domain controllers because it lacks the necessary SRV records. Without proper DNS resolution, the domain join process will fail with errors indicating that the domain could not be found.
How do I fix time sync errors during domain join?
Kerberos authentication requires time differences to be less than five minutes. Synchronize the clock on both the client and the server to the same NTP source, or ensure the host OS time is accurately reflected in the guest VMs.
Is it possible to join a workgroup instead of a domain?
Yes, but this bypasses centralized management. Joining a workgroup places the machine in a peer-to-peer network where resources are shared locally rather than through Active Directory policies and group objects.