本頁面說明如何使用自動加入網域功能，將 Google Kubernetes Engine (GKE) 叢集中的 Windows Server 節點加入受管理的 Microsoft AD 網域。
自動將 Windows Server 節點加入網域的 Managed Microsoft AD 運作方式
在 GKE 叢集中建立節點集區時，您可以使用 Managed Microsoft AD 提供的現成指令碼，自動加入 Managed Microsoft AD 網域。GKE 建立節點集區後，Managed Microsoft AD 會啟動網域加入要求，並嘗試將節點與您的網域建立連線。如果網域加入要求成功，Managed Microsoft AD 就會將節點加入您的網域。如果網域加入要求失敗，則已建立的節點會繼續執行。您必須檢查記錄檔，找出並修正問題，才能再次建立節點集區。詳情請參閱「查看偵錯記錄」。
在某些特定情況下，您必須手動清理受管理 Microsoft AD 中未加入節點的資訊。詳情請參閱「清理未加入的 VM」。
在 Managed Microsoft AD 網域和節點網路之間設定網域對等連線，或是讓 Managed Microsoft AD 網域和節點位於同一個網路中。
在具有 Managed Microsoft AD 網域的專案中，建立具有 Google Cloud Managed Identities Domain Join (roles/managedidentities.domainJoin) IAM 角色的服務帳戶。詳情請參閱「Cloud 管理式身分識別資訊角色」。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Join GKE Windows Server nodes automatically to a Managed Microsoft AD domain\n\nThis page explains how to join Windows Server nodes in your\nGoogle Kubernetes Engine (GKE) cluster to a Managed Microsoft AD domain using\nthe [automated domain join](/managed-microsoft-ad/docs/seamless-domain-join-gce)\nfeature.\n\nHow Managed Microsoft AD joins Windows Server nodes automatically to a domain\n-----------------------------------------------------------------------------\n\nWhen you create a [node pool](/kubernetes-engine/docs/concepts/node-pools) in\nyour [GKE\ncluster](/kubernetes-engine/docs/concepts/cluster-architecture), you can use the\nready-made scripts that are available from Managed Microsoft AD to\nautomatically join your Managed Microsoft AD domain. After\nGKE creates the node pool, Managed Microsoft AD\ninitiates the domain join request and attempts to join the nodes with your\ndomain. If the domain join request succeeds, Managed Microsoft AD\njoins the nodes to your domain. If the domain join request fails, the created\nnodes continue to run. You need to check the logs to identify and fix the issue\nbefore creating the node pool again. For more information, see [View debug\nlogs](/managed-microsoft-ad/docs/seamless-domain-join-gce#view-logs).\n\nYou need to clean up the information about unjoined nodes manually from\nManaged Microsoft AD in some specific scenarios. For more information, see\n[Clean up unjoined\nVMs](/managed-microsoft-ad/docs/seamless-domain-join-gce#cleanup-vm).\n\nYou can't update an existing node pool with the domain join scripts to\nautomatically join the existing nodes to your domain.\n\nThe automated domain join feature doesn't configure the GKE\nnodes to run with\n[gMSA](https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts)\nfor authentication. However, you can manually [create a\ngMSA](/managed-microsoft-ad/docs/create-gmsa) in Managed Microsoft AD and\nconfigure the GKE nodes to use the gMSA. For information\nabout configuring gMSA for the GKE nodes, see [Configure\ngMSA for Windows Pods and\ncontainers](https://kubernetes.io/docs/tasks/configure-pod-container/configure-gmsa/).\n\nBefore you begin\n----------------\n\n1. [Create a Managed Microsoft AD\n domain](/managed-microsoft-ad/docs/create-domain).\n\n2. [Create a GKE cluster using Windows Server node\n pools](/kubernetes-engine/docs/how-to/creating-a-cluster-windows).\n\n3. Make sure that the Windows Server nodes run on a [Windows version that\n Managed Microsoft AD\n supports](/managed-microsoft-ad/docs/os-versions#windows-domain-join).\n\n4. [Configure domain\n peering](/managed-microsoft-ad/docs/quickstart-domain-peering) between the\n Managed Microsoft AD domain and the nodes' network, or have both the\n Managed Microsoft AD domain and the nodes in the same network.\n\n5. Create a service account with the Google Cloud Managed Identities Domain\n Join (`roles/managedidentities.domainJoin`) IAM role on the\n project that has the Managed Microsoft AD domain. For more information,\n see [Cloud Managed Identities\n roles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n\n - For more information about granting roles, see [Grant a single\n role](/iam/docs/manage-access-service-accounts#grant-single-role).\n\n - For information about creating a service account, see [Authenticate\n workloads using service\n accounts](/compute/docs/access/create-enable-service-accounts-for-instances).\n\n6. Set the full `cloud-platform` access scope on the Windows Server nodes. For\n more information, see\n [Authorization](/compute/docs/access/service-accounts#authorization).\n\nMetadata\n--------\n\nYou need the following metadata keys to join your Windows Server nodes to a\ndomain.\n\n- `windows-startup-script-url`\n- `managed-ad-domain`\n- Optional: `enable-guest-attributes`\n- Optional: `managed-ad-ou-name`\n- Optional: `managed-ad-force`\n\nFor more information about these metadata keys, see\n[Metadata](/managed-microsoft-ad/docs/seamless-domain-join-gce#metadata).\n\nThe domain join request fails when the computer account of a Windows Server node\nalready exists in Managed Microsoft AD. For Managed Microsoft AD to\nreuse the existing computer account during the domain join process, you can use\nthe `managed-ad-force` metadata key when you [create the node\npool](/kubernetes-engine/docs/how-to/node-pools#add).\n\nJoin Windows Server nodes\n-------------------------\n\nYou can configure these [metadata\nkeys](/managed-microsoft-ad/docs/automated-domain-join-gke#metadata) when you\nadd a Windows Server node pool to your GKE cluster. This\nsection illustrates how to use these metadata keys in gcloud CLI\ncommands when you create a node pool.\n\nHowever, you can use these metadata keys when you create a node pool using the\nother available options as well. For more information, see [Add and manage node\npools](/kubernetes-engine/docs/how-to/node-pools).\n\nTo create a node pool and join the Windows Server nodes, run the following\ngcloud CLI command: \n\n```\ngcloud container node-pools create NODE_POOL_NAME \\\n --cluster=CLUSTER_NAME \\\n \"--metadata=windows-startup-script-url=URL,managed-ad-domain=DOMAIN_RESOURCE_PATH,managed-ad-force=TRUE\" \\\n --service-account=SERVICE_ACCOUNT \\\n --image-type=WINDOWS_IMAGE_NAME \\\n --scopes=https://www.googleapis.com/auth/cloud-platform \\\n --location=ZONE_OR_REGION \\\n --no-enable-autoupgrade\n```\n\nYou can replace the placeholders in the `--metadata` flag with relevant values\nas described in the\n[metadata](/managed-microsoft-ad/docs/seamless-domain-join-gce#metadata)\nsection.\n\nFor more information about this gcloud CLI command, see [gcloud\ncontainer node-pools create](/sdk/gcloud/reference/container/node-pools/create).\n\nWhat's next\n-----------\n\n- [Join a Windows VM automatically to a\n domain](/managed-microsoft-ad/docs/seamless-domain-join-gce)."]]
