detection.wiki

NetJoin

6 events across 1 channel

EventTitleChannelSample
4096The machine ComputerName successfully joined the domain DomainName.SystemY
4097The machine ComputerName attempted to join the domain DomainName but failed.SystemY
4098The machine {ComputerName} successfully completed an offline domain join to the …SystemN
4099The machine {ComputerName} attempted to join the domain {DomainName} while …SystemN
4100During domain join, the domain controller contacted found an existing computer …SystemN
4101During domain join, the domain controller contacted found an existing computer …SystemN

Event ID 4096: The machine ComputerName successfully joined the domain DomainName.

#
Provider
NetJoin
Channel
System
Level
Informational

Description

The machine ComputerName successfully joined the domain DomainName.

Message #

The machine %2 successfully joined the domain %1.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString

Example Event #

{
  "system": {
    "provider": "NetJoin",
    "guid": "9741FD4E-3757-479F-A3C6-FC49F6D5EDD0",
    "event_source_name": "",
    "event_id": 4096,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-10T01:11:24.544193+00:00",
    "event_record_id": 826,
    "correlation": {},
    "execution": {
      "process_id": 2684,
      "thread_id": 5968
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "DomainName": "ludus.domain",
    "ComputerName": "LAB-WIN11"
  },
  "message": ""
}

Event ID 4097: The machine ComputerName attempted to join the domain DomainName but failed.

#
Provider
NetJoin
Channel
System
Level
Error

Description

The machine ComputerName attempted to join the domain DomainName but failed. The error code was NetStatusCode.

Message #

The machine %2 attempted to join the domain %1 but failed. The error code was %3.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString
NetStatusCode UInt32

Example Event #

{
  "system": {
    "provider": "NetJoin",
    "event_id": 4097,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T02:46:48.3651604+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "System"
  },
  "event_data": {
    "NetStatusCode": "5",
    "ComputerName": "DESKTOP-FF3N5XK",
    "DomainName": "ludus.domain"
  }
}

Event ID 4098: The machine {ComputerName} successfully completed an offline domain join to the domain {DomainName}.

#
Provider
NetJoin
Channel
System

Description

The machine {ComputerName} successfully completed an offline domain join to the domain {DomainName}.

Message #

The machine {ComputerName} successfully completed an offline domain join to the domain {DomainName}.

Fields #

NameDescription
ComputerName
DomainName

Event ID 4099: The machine {ComputerName} attempted to join the domain {DomainName} while offline but failed.

#
Provider
NetJoin
Channel
System

Message #

The machine {ComputerName} attempted to join the domain {DomainName} while offline but failed. The computer name was set to {ComputerName}. A common cause of failure is the SKU does not support domain join; see the error code for more information. The error code was {NetStatusCode}.

Fields #

NameDescription
ComputerName
DomainName
NetStatusCode

Event ID 4100: During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.

#
Provider
NetJoin
Channel
System

Description

During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.

Message #

During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.
An attempt to re-use this account was permitted. 

Domain controller searched: %1
Existing computer account DN: %2

See https://go.microsoft.com/fwlink/?linkid=2202145 for more information.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString

Event ID 4101: During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.

#
Provider
NetJoin
Channel
System

Description

During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.

Message #

During domain join, the domain controller contacted found an existing computer account in Active Directory with the same name.
An attempt to re-use this account was prevented for security reasons.

Domain controller searched: %1
Existing computer account DN: %2
The error code was %3.

See https://go.microsoft.com/fwlink/?linkid=2202145 for more information.

Fields #

NameDescription
DomainName UnicodeString
ComputerName UnicodeString
NetStatusCode UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9741fd4e-3757-479f-a3c6-fc49f6d5edd0

Defined in netjoin.dll, which carries the event manifest.

Observed on:

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads