How to fix Error 1356 on Windows 11

by

Troubleshooting Guide: Error 1356 – “The Specified Domain Already Exists”

Why This Error Happens

This error typically occurs when a Windows 11 machine has conflicting or stale domain trust information, often caused by NetBIOS name collisions between a workgroup and an existing Active Directory domain name. It can also result from corrupted local security database entries (SAM/SECURITY hives) or duplicate SPNs (Service Principal Names) registered in Active Directory. In virtualized or cloned environments, this frequently happens when two machines share identical machine SIDs or domain identifiers due to improper sysprep procedures.

Step-by-Step Resolution Guide

Step 1: Verify Domain and NetBIOS Name Conflicts

  • Open Command Prompt as Administrator and run nltest /dsgetdc:yourdomain.com to check domain controller resolution.
  • Confirm there isn’t a workgroup name on the local machine matching the target Active Directory domain’s NetBIOS name (check via Settings > System > About > Rename this PC).
  • Rename the local workgroup temporarily if a conflict is found.

Step 2: Clear Stale Computer Account in Active Directory

  • On a domain controller, open Active Directory Users and Computers (ADUC).
  • Locate the computer object under the Computers OU and delete any duplicate or stale entry for the machine attempting to join.
  • Run repadmin /syncall /AdeP on the DC to force replication across all domain controllers before retrying the join.

Step 3: Reset the Machine Account and Rejoin

  • On the Windows 11 client, disconnect from the domain first: go to Settings > Accounts > Access work or school, remove the connection, and reboot into a local admin account.
  • Clear cached credentials using cmdkey /list and cmdkey /delete:<TargetName> for any stale domain credentials.
  • Rejoin the domain via Settings > System > About > Domain or workgroup, and re-enter valid domain admin credentials.

Step 4: Check for SID Duplication (Cloned Machines)

  • If this VM/PC was cloned or imaged, verify unique SIDs using wmic useraccount get name,sid or PowerShell Get-WmiObject Win32_ComputerSystemProduct.
  • Run sysprep /generalize /oobe /reboot from C:\Windows\System32\Sysprep if duplication is confirmed, then re-image properly.

Alternative or Verification Steps

  • After rejoining, confirm success by running whoami /fqdn in Command Prompt — it should return the correct domain path without errors.
  • If the issue persists, use DCDiag (dcdiag /v) on the domain controller to check for underlying AD replication or DNS misconfigurations preventing clean domain joins.