220-1102 Question 385
Single answerJoining domainA technician is preparing a new Windows 11 Pro laptop for an employee. The company uses an on-premises Active Directory domain named CORP.EXAMPLE.COM. The laptop is connected to the corporate network and can browse internal websites. When the technician opens System settings and tries to join the device to the domain, the process fails with a message that the domain cannot be contacted. The user confirms the laptop was imaged correctly and has a valid company account. Which action should the technician take FIRST to resolve this issue?
- A
Verify the laptop is using the organization's internal DNS servers instead of a public DNS server
- B
Upgrade Windows 11 Pro to Windows 11 Enterprise so it can join the domain
- C
Create a local administrator account on the laptop before attempting the domain join again
- D
Disable Windows Defender Firewall on the laptop and retry the domain join
Show answer and explanation
Correct answer: A
Explanation
The best first action is to verify DNS configuration. In Active Directory environments, clients must use DNS servers that host or can resolve the AD domain's records, especially SRV records used to find domain controllers. Public DNS servers such as 8.8.8.8 cannot resolve internal AD service records unless specifically configured, so domain join commonly fails even when general internet or limited internal access appears to work. Windows Pro editions support joining traditional on-premises domains, so an edition upgrade is unnecessary. Best practice is to troubleshoot network configuration methodically, starting with IP settings and DNS, rather than disabling security features. Microsoft documentation for Active Directory domain services and domain join troubleshooting consistently emphasizes proper DNS configuration as a core requirement.
- A. Correct.
This is correct. Active Directory domain joins rely heavily on DNS to locate domain controllers through SRV records. A device can still access websites or some internal resources while using the wrong DNS server, but it will often fail to locate the domain during the join process. Verifying that the client is pointed to the organization's internal DNS infrastructure is a standard first troubleshooting step.
- B. Incorrect.
This is incorrect. Windows 11 Pro already supports joining an on-premises Active Directory domain. Enterprise edition may add management and security features, but it is not required for basic domain join capability.
- C. Incorrect.
This is incorrect. A local administrator account can be useful for device management, but it is not a prerequisite for joining a domain. The issue described points more directly to name resolution or domain controller discovery rather than a missing local admin account.
- D. Incorrect.
This is incorrect. Although firewall rules can affect network communication, disabling Windows Defender Firewall is not the best first step and is not typical best practice. In a domain-join scenario where the error says the domain cannot be contacted, DNS misconfiguration is far more common and should be checked before reducing security controls.