How to Join Windows Server Core to Active Directory Using SConfig

Start by logging into your Windows Server Core installation as the local Administrator. SConfig launches automatically after login, but if you need to start it manually, simply type sconfig at the command prompt.

First, let's set a meaningful computer name before joining the domain. This makes identification easier in Active Directory.

sconfig

From the SConfig main menu, select option 2 (Computer Name) and press Enter. Type a new hostname for your server, such as SRV01 or FILESERVER01, following your organization's naming convention.

When prompted to restart, type y and press Enter. The server will reboot with the new name.

Proper network configuration is critical for domain join success. Your server must be able to resolve the domain controller's FQDN and communicate over the required ports.

From the SConfig main menu, select option 8 (Network Settings) and press Enter. You'll see a list of network adapters. Select the adapter you want to configure (usually option 1 for the primary adapter).

Configure the network adapter with these settings:

• Set a static IP address in your domain's subnet
• Configure the subnet mask appropriately
• Set the default gateway to your network gateway
• Most importantly, set the DNS server to your domain controller's IP address

# Example configuration:
# IP Address: 192.168.1.100
# Subnet Mask: 255.255.255.0
# Default Gateway: 192.168.1.1
# DNS Server: 192.168.1.10 (your DC's IP)

After configuring the network settings, exit SConfig by selecting option 15 (Exit to Command Line). Test DNS resolution to ensure your server can reach the domain controller:

ping dc01.contoso.com
nslookup contoso.com

Active Directory requires accurate time synchronization. Kerberos authentication will fail if the time difference between your server and the domain controller exceeds 5 minutes.

Return to SConfig by typing sconfig and select option 9 (Date and Time). Verify the current date and time are correct. If adjustment is needed, follow the prompts to set the correct values.

For automatic time synchronization with your domain controller, you can configure the Windows Time service:

w32tm /config /manualpeerlist:"dc01.contoso.com" /syncfromflags:manual
w32tm /resync

Check the time synchronization status:

w32tm /query /status

Now for the main event - joining your Server Core to the Active Directory domain. From the SConfig main menu, select option 1 (Domain/Workgroup) and press Enter.

You'll see the current domain/workgroup status. Select D for Domain to begin the domain join process.

Enter your domain's fully qualified domain name (FQDN). For example, if your domain is contoso.com, type exactly that:

contoso.com

When prompted for credentials, provide a domain account with permission to join computers to the domain. This is typically a Domain Administrator account, but can be any account with the "Add workstations to domain" right:

# Format: DOMAIN\username
# Example: CONTOSO\administrator
# Or: administrator@contoso.com

Enter the password when prompted. The system will attempt to contact the domain controller and join the domain.

When asked if you want to change the computer name, you can select N since we already configured it in step 1. When prompted to restart, select Y to complete the domain join process.

After the server restarts, you need to verify the domain join was successful and test domain authentication.

At the login screen, press Esc to access the "Other user" option. This allows you to log in with domain credentials instead of local accounts.

Log in using a domain account:

# Username: CONTOSO\yourusername
# Or: yourusername@contoso.com
# Password: [your domain password]

Once logged in, SConfig should start automatically. The main screen will now show your server is a member of the domain rather than a workgroup.

To verify the domain join from the command line, exit SConfig (option 15) and run these verification commands:

# Check computer domain membership
Get-ComputerInfo | Select-Object CsDomain, CsWorkgroup

# Verify domain controller connectivity
nltest /dsgetdc:contoso.com

# Test domain trust relationship
nltest /sc_query:contoso.com

You can also verify the computer account was created in Active Directory by checking the Computers container in Active Directory Users and Computers on your domain controller.

With your server successfully joined to the domain, configure remote management capabilities for easier administration.

From SConfig, select option 4 (Configure Remote Management). Enable remote management by selecting 1 (Enable Remote Management). This configures Windows Remote Management (WinRM) and adjusts firewall rules.

For Remote Desktop access, select option 7 (Remote Desktop) from the main SConfig menu. Choose option 1 (Enable Remote Desktop) and select the appropriate security level:

• Option 1: Enable Remote Desktop with Network Level Authentication (recommended)
• Option 2: Enable Remote Desktop without Network Level Authentication (less secure)

Configure Windows Firewall if needed. From SConfig option 6 (Windows Update Settings), you can also configure automatic updates for security patches.

To enable PowerShell remoting for advanced management:

Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force