Windows 11 behaving strangely after AD join

Question

Hi everyone.

For the past couple days I tried to get my new-ish laptop working in the office environment and Active Directory (Windows Server 2016 on current updates, several DCs). The machine was in use by another user before and rather than cleaning his stuff up, I preferred a clean install, so I did with the built-in tools from Dell. After having a clean Windows 10, I upgraded to 11 immediately, and joined the AD. Here is where the problems began.

I have two types of user accounts in the domain, the regular one with full local administrative and another one with full domain administrative rights. Now after the domain join, whenever a process needed elevated rights, I could only get them working with the credentials of the local account created during installation. I couldn't open CMD or PowerShell with either domain account on elevated levels.

So I did the sensible thing: created a Win11 boot stick, reinstalled from scratch but 11 immediately, deleted the computer entry in AD and started again. To my demise, the very same thing happened. Now I'm on try 3 (yes, Einstein's famous quote, I know) and still have the same issues. Strangely enough, even Winget won't work at all with the domain accounts, PowerShell doesn't recognize 'winget' as part of a cmdlet. On the local install account, it works perfectly fine. Since I have quite the number of tools and programs to install (I will NOT call them 'apps', sue me), I want to do this (among other things) on my regular AD account with a PowerShell script that takes care of a number of other settings as well. Would save about 5 hours of config time, if I could get it to work, but again - no elevated PS session since the credentials won't be accepted and no winget recognition either.

On my old laptop I use Win 11 in the domain for a little over a year now without any hassle whatsoever. This issue occurs on a VPN connection from home as well as on a wired LAN connection in the office. Both methods let me ping and remote-connect to all domain servers as well. GPupdate and several restarts brought no relief either. I am a sysadmin in my dayjob and I have three other sysadmins beside me (one has probably forgotten more about IT than the other three of us combined ever knew), and they are just as baffled about this as I am.

However I would like to continue to use Win11 on my new machine, since little things like the dark mode in Notepad have been a very welcome addition.

So I am at the mercy of all of you. Has anyone encountered similar problems with Win11, and how did you fix that?

Thanks in advance!

Answer 1

I have two types of user accounts in the domain, the regular one with full local administrative and another one with full domain administrative rights. Now after the domain join, whenever a process needed elevated rights, I could only get them working with the credentials of the local account created during installation. I couldn't open CMD or PowerShell with either domain account on elevated levels.

I'd check that the problematic domain accounts have been added to the local administrators group.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi DSPatrick,

thank you for the hint. After adding my user account to the Local Admins AD group I was able to finish configuration and can use the notebook now. Now I only have to find out why the admin account doesn't work and why I was able to administrate my old notebook with the user account...