# Windows



# Validating AD Machine Account

<p class="callout info">NOTE: If you are looking to fix a machine account, see this page: [Windows: Repair a Domain Machine Account](https://wiki.galaxydump.com/link/603)</p>

Here's a couple ways to validate the machine account of a PC in an Active Directory domain:

<p class="callout info">NOTE: This must be run from an elevated window.</p>

```
dsregcmd /status
```

If successful, it will output a device state of DomainJoined: yes.

[![image.png](https://wiki.galaxydump.com/uploads/images/gallery/2025-06/scaled-1680-/42OdEyuusCj3aEV3-image.png)](https://wiki.galaxydump.com/uploads/images/gallery/2025-06/42OdEyuusCj3aEV3-image.png)

<p class="callout info">NOTE: It outputs several blocks of info. So, you may have to scroll up to see the status.</p>

Also. You can use this:

<p class="callout info">NOTE: This must be run from an elevated window.</p>

```
nltest /sc_query:<<domain name>>
```

If successful, it will give a NERR\_Success status, like this:

[![image.png](https://wiki.galaxydump.com/uploads/images/gallery/2025-06/scaled-1680-/CKNKbSm6W1Vcdo73-image.png)](https://wiki.galaxydump.com/uploads/images/gallery/2025-06/CKNKbSm6W1Vcdo73-image.png)

# Windows: Repair a Domain Machine Account

Here's a quick way to repair the domain membership for a machine account.

It doesn't require two reboots and new machine account churn.

To do so, open an elevated command line prompt and do this:

```bash
Test-ComputerSecureChannel -Verbose
# and only if that returns False:
Test-ComputerSecureChannel -Repair -Credential MFGDUR\<your-admin-account>
```

The repair resets the machine-account password with the domain in seconds, no reboot, no rejoin.

Once executed, verify domain membership, by following this page: [Validating AD Machine Account](https://wiki.galaxydump.com/link/266)