How to Add an RDP Server to an Active Directory Domain: Step-by-Step PowerShell & GUI Guide

In enterprise environments, managing standalone Windows VPS or Remote Desktop (RDP) servers individually creates security vulnerabilities, fragmented local user databases, and inconsistent group policy enforcement. Joining an RDP server to an Active Directory Domain Services (AD DS) domain establishes centralized identity management via Kerberos authentication, uniform Group Policy Object (GPO) deployment, and automated Remote Desktop Session Host (RDSH) licensing integration.

This technical system administration guide details the prerequisites for domain connectivity (DNS and SRV record resolution), provides step-by-step instructions via PowerShell (Add-Computer) and the Windows GUI (sysdm.cpl), configures Active Directory group membership for Remote Desktop Users, and troubleshoots common NetBIOS and Kerberos trust errors.

Prerequisites and network DNS verification

Before attempting to join an RDP server to a domain, verify that the server’s network adapter points directly to your domain controller’s DNS server rather than public resolvers (such as 8.8.8.8 or 1.1.1.1):

1. Configure Primary DNS: Set the primary DNS server on your RDP server’s network adapter to the internal IP address of the Domain Controller.
2. Test SRV LDAP Resolution via PowerShell:

   # Test Active Directory LDAP SRV record resolution
   Resolve-DnsName -Name _ldap._tcp.dc._msdcs.yourdomain.local -Type SRV

   If this query returns the IP address and hostname of your Domain Controller, DNS resolution is functioning properly.
3. Verify Domain Reachability:

   Test-NetConnection -ComputerName "dc01.yourdomain.local" -Port 389

Method 1: Join RDP server to domain via PowerShell (Recommended)

The cleanest and most reliable method is running the Add-Computer cmdlet in an elevated PowerShell prompt:

# Join computer to domain and reboot immediately
Add-Computer -DomainName "yourdomain.local" -Credential (Get-Credential) -Restart -Force

When prompted by PowerShell, enter your Domain Administrator credentials (e.g. YOURDOMAIN\Administrator) and password. The server will authenticate, create the Active Directory computer object, and reboot automatically.

Method 2: Join RDP server to domain via Windows GUI

1. Press Win + R, type sysdm.cpl, and press Enter to open System Properties.
2. Under the Computer Name tab, click the Change… button.
3. Under Member of, select the Domain radio button and enter your fully qualified domain name (FQDN, e.g. corp.yourdomain.com).
4. Click OK and enter your Domain Administrator credentials when prompted.
5. Click OK on the “Welcome to the yourdomain domain” message and reboot the server.

Step 3: Grant Remote Desktop permissions to Active Directory users

By default, only members of the Domain Admins group can log in to a newly domain-joined server over RDP. To allow standard domain users or specific organizational units (OUs) to connect:

1. Open Computer Management (compmgmt.msc) > Local Users and Groups > Groups.
2. Double-click the local Remote Desktop Users group.
3. Click Add…, set Locations to your domain, and add your domain security group (e.g. YOURDOMAIN\Remote-Employees).
4. Click Apply and OK.

Automate via PowerShell:

# Add domain security group to local Remote Desktop Users group
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "YOURDOMAIN\Remote-Employees"

Troubleshooting domain join errors

• Error: “An Active Directory Domain Controller could not be contacted”:

  Cause: The RDP server is querying a public DNS resolver or local firewall is blocking TCP/UDP ports 53 (DNS), 88 (Kerberos), 389 (LDAP), or 445 (SMB).

• Error: “The specified domain either does not exist or could not be contacted (0x8007054B)”:

  Fix: Verify NetBIOS over TCP/IP is enabled on the network adapter properties and flush local DNS cache: ipconfig /flushdns.

• Error: “The trust relationship between this workstation and the primary domain failed”:

  Fix: Reset the secure machine account channel via PowerShell:

  Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

For dedicated enterprise environments, high-availability Active Directory clusters, and low-latency cloud infrastructure, explore Aminserve Windows Cloud VPS and Enterprise RDP Solutions with 24/7 technical support.