Fix 0X00000A84: Machine Not Joined to Domain

You're working on a Windows 10 or Server 2019 machine that's been domain-joined for months. Then out of nowhere — maybe after a failed update or a forced reboot — an application or a script throws the error: 0X00000A84 with the message "This machine is not currently NERR_SetupNotJoined joined to a domain". The weird part? You can still log in with domain credentials, whoami shows the domain, and dsregcmd /status looks fine. The system is joined, but something is telling the API that it isn't.

Why This Happens

The error code 0X00000A84 maps to NERR_SetupNotJoined (technically NERR_SetupNotJoined isn't a real constant name — it's a mashup in the message string, but the code itself is 22214 in decimal, which is NERR_DCNotFound in some older NetApi32 docs). What's actually happening is that the NetGetJoinInformation API call is returning NetSetupUnknownStatus or NetSetupUnjoined because the registry key that stores the domain membership status is corrupted or missing.

The trigger is often a botched Windows update that rewrites the JoinDomain or Active Directory values in HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, or a third-party security tool that locks the registry hive during a scan. The result is a false negative: the domain trust is intact, but Windows can't read the "I'm joined" flag.

How to Fix It

Step 1: Verify the Domain Status

Before you mess with anything, confirm the machine is actually joined. Open PowerShell as admin and run:

(Get-WmiObject Win32_ComputerSystem).PartOfDomain

If it returns True, you're in a domain. If False, the error is telling the truth — skip to Step 3.

If True, the issue is the registry. Run:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name 'Domain'

Does it show your domain FQDN? Good. Now check:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name 'NV Domain'

If NV Domain is missing or empty, that's your culprit — the API reads NV Domain, not Domain.

Step 2: Rebuild the Registry Key

The fix is straightforward: copy the Domain value to NV Domain. In PowerShell:

$domain = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name 'Domain').Domain
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name 'NV Domain' -Value $domain

Reboot. The error should disappear.

Why does this work? The NetGetJoinInformation API pulls the join status from NV Domain (the non-volatile stored domain name). If that key is missing, it defaults to NetSetupUnknownStatus, which triggers the NERR_SetupNotJoined error. The Domain key is used by the TCP/IP stack for DNS suffix, not for join status — they get out of sync after an update that touches the network stack.

Step 3: Rejoin the Domain (If Registry Fix Fails)

If the registry key is present but the error persists, or if PartOfDomain was False, you need to rejoin. Open PowerShell as admin:

Remove-Computer -UnjoinDomain -Force -Credential (Get-Credential DOMAIN\AdminAccount)
Restart-Computer -Force

After reboot, rejoin:

Add-Computer -DomainName 'yourdomain.com' -Credential (Get-Credential DOMAIN\AdminAccount) -Restart

This is nuclear — it resets the computer account in AD, so you'll need domain admin creds. I'd try the registry fix first every time.

Still Failing? Check These

DNS: Can the machine resolve the domain controller? Run nslookup yourdomain.com. If it fails, fix your DNS server settings in the NIC.
Time Sync: Kerberos requires time within 5 minutes of the DC. Run w32tm /resync.
Secure Channel: Even if joined, the trust may be broken. Test with Test-ComputerSecureChannel -Repair.
Corrupted SID: Rare, but a system restore from a non-domain backup can leave the SID mismatched. In that case, you're looking at a rejoin.

I've seen this error most often after a Windows 10 22H2 feature update that rewrites TCP/IP parameters. The registry fix in Step 2 has worked every time for me since 2021. Don't overthink it — check NV Domain, fix it, reboot.