Fix NERR_LogonDomainExists 0X000008A8 on Windows 10/11

You'll see error 0X000008A8 when a domain join fails because Windows thinks the computer already belongs to that domain. Here's why and how to fix it.

When this error hits

You're joining a Windows 10 or 11 machine (Pro/Enterprise) to a domain — say corp.example.com. You type the admin credentials, hit OK, and seconds later you get:

There is already a logon domain for this computer
NERR_LogonDomainExists (0X000008A8)

This usually happens after you've removed the machine from the domain (maybe left it hanging in a workgroup), or you're trying to reuse a computer name that was already joined to the same domain by another machine. Seen it more often on machines that were domain-joined, then unjoined improperly — say, by wiping the local system and imaging it fresh, but leaving the old AD computer account alive.

What's actually happening here

Windows keeps track of the machine's domain membership in two places: the registry (under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters) and the local SAM database. When you try to join a domain, Windows checks if that domain name is already recorded locally. If it finds a match, it throws NERR_LogonDomainExists and refuses to proceed.

The root cause is either:

A stale registry key that still holds the old domain name.
An existing computer account for that name in Active Directory — the Windows client sees the domain responce from the DC and thinks it's already a member.

You can't just rejoin blindly because Windows won't let you. You have to manually purge the local domain reference and then clean up the AD side.

Fix: Clear the local domain reference

Leave the current workgroup (if the machine is already on a workgroup, skip this). Go to Settings > System > About, click Rename this PC, and change the workgroup name to something random like TEMPWORKGROUP. Reboot when prompted. This forces Windows to drop any domain association.
Check the registry for leftover domain crap. Open regedit.exe and navigate to:
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
```
Look for a value named Domain. If it still shows your target domain (e.g., corp.example.com), delete it. Also check NV Domain — same drill. Don't touch anything else in there unless you know what you're doing.
Clean the computer account from Active Directory. On a domain controller or a machine with RSAT, open Active Directory Users and Computers. Find the computer object under Computers (or wherever your org stashes them). Right-click and delete it. Wait 5–10 minutes for replication to complete across DCs — or force it with repadmin /syncall if you're impatient.
Rejoin the domain. Back on the client machine, go to Settings > System > About, click Rename this PC (Advanced), then under Computer Name/Domain Changes, select Domain and type your domain. Provide domain admin credentials when prompted. Reboot.

If it still fails

Sometimes the registry cleanup isn't enough because Windows cached the domain info in the SAM database. The nuclear option: reinstall the local SAM by running netdom remove <computername> /domain:<domain> /UserD:<admin> /PasswordD:* from an elevated command prompt. This explicitly removes the computer from the domain even if the local machine thinks it's already there. You'll need network connectivity to a DC for this to work.

Another gotcha: the computer name might be too long (over 15 characters) or contain special characters. Domain join can choke on names like DESKTOP-ABC1234 if they start with a number. Rename the PC to something shorter and cleaner before retrying the join.

One more thing — if you're dealing with a cloned VM or a sysprepped image, make sure the machine has a unique SID. Running sysprep /generalize before cleanup avoids a ton of trust problems. I've seen NERR_LogonDomainExists pop up on cloned VMs because the domain controller saw two machines with the same name and same SID trying to join. Deleting the AD account and re-running sysprep fixed it.

And if you're still stuck, check the DNS settings on the client. The machine must be able to resolve the domain controller's IP via nslookup yourdomain.com. No DNS = no domain join. That's not going to show up as error 0X000008A8 directly, but it can cause a confusing cascade where the join fails halfway and leaves the machine in a broken state.