How Windows 2000 Joins an Active Directory Domain

Joining a Microsoft Windows 2000 Professional workstation to an Active Directory domain is a multi-step sequence involving network service discovery, administrative authentication, directory object manipulation, and local security configuration. The process relies on standard networking protocols—principally DNS, Kerberos, LDAP, and SMB/RPC—to locate a domain controller, verify delegated rights, create a machine account, establish a shared trust secret, and configure the local machine to recognize domain authorities.

1. Domain Controller Discovery (DC Locator)

The join sequence initiates when an administrator submits domain credentials in the Network Identification properties dialog. Windows 2000 locates an appropriate Domain Controller (DC) using the DC Locator mechanism:

  • DNS Query: The workstation's Netlogon service queries the configured DNS server for Service (SRV) resource records under the domain name, specifically querying _ldap._tcp.dc._msdcs.<DomainName>.
  • LDAP Ping: Upon receiving the IP addresses of available DCs, the workstation sends an LDAP ping (a connectionless UDP message) to port 389 of the candidate DCs to verify availability, latency, and site membership.
  • NetBIOS Fallback: If DNS resolution fails, the client falls back to NetBIOS over TCP/IP (WINS or subnet broadcasts) to resolve the DomainName<1C> record to discover domain controllers.

2. User Authentication and Privilege Verification

Once a responsive Domain Controller is selected, the client prompts for or uses provided administrative credentials to authenticate:

  • The workstation negotiates an authenticated connection with the DC using Kerberos v5 (if the client already has access to a Kerberos realm) or NTLM over an SMB/RPC session to the IPC$ share.
  • The DC checks the user's access token to verify that the account possesses the "Add workstations to domain" privilege or explicit Active Directory write permissions to create computer objects in the target organizational unit (OU).

3. Computer Account Creation via LDAP

After validating credentials, the workstation establishes an LDAP connection over TCP port 389 to create or claim the machine account:

  • Object Lookup: The client queries Active Directory for an existing object matching the workstation's NetBIOS name (with a trailing $ sign, such as WORKSTATION$) of object class computer.
  • Object Provisioning: If no account exists, an LDAP addRequest creates the computer object within the default CN=Computers container. If a pre-staged account exists, the client requests permission to reset its password.
  • Initial Password Assignment: The computer account's initial password is set by default to the lowercase version of the computer's NetBIOS name.

4. Establishing the Secure Channel (Netlogon)

To allow the workstation to authenticate users against the domain, a mutual trust relationship—known as a secure channel—is formed between the workstation and the DC:

  • The workstation's Local Security Authority (LSA) interacts with the Netlogon service.
  • A shared secret (machine account password) is negotiated and synchronized between the workstation's local SAM/LSA secrets storage and the Active Directory database.
  • This secure channel uses Remote Procedure Calls (RPC) encrypted with session keys derived from the shared machine secret to protect future authentication requests.

5. Local System Configuration Updates

Once the secure channel is validated, the workstation executes several local modifications:

  • Registry Updates: The client updates registry keys under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to set the Primary DNS Suffix to match the domain name, and updates HKLM\SECURITY with the domain's Security Identifier (SID).
  • Local Group Membership: The domain's Domain Admins global group is automatically added to the workstation’s local Administrators group, and the Domain Users group is added to the local Users group.
  • System Reboot: The machine prompts for a reboot. Upon restart, the Winlogon interface loads the new domain into the logon drop-down menu, allowing users to authenticate via Kerberos against Active Directory.