This page provides instructions to configure your Windows Server nodes
in your Google Kubernetes Engine (GKE) cluster to automatically join an Active
Directory (AD) domain.
If you want to use the Google Cloud CLI for this task,
install and then
initialize the
gcloud CLI. If you previously installed the gcloud CLI, get the latest
version by running gcloud components update.
NUMBER_OF_NODES: the number of Linux nodes to
create. You should provide sufficient compute resources to run cluster
add-ons. This is an optional field and, if omitted, uses the default
value of 3.
VERSION: the GKE cluster version,
which must be 1.17.14-gke.1200 or later or
1.18.9-gke.100 or later. You can also use the --release-channel
flag to enroll the cluster in a release channel.
--enable-ip-alias turns on alias IP. Alias IP is
required for Windows Server nodes.
MACHINE_TYPE_NAME: the machine type. n1-standard-2
is the minimum recommended machine type as Windows Server nodes require
additional resources. Machine types f1-micro and g1-small are not
supported. Each machine type is billed differently. For more
information, refer to the machine type price sheet.
Your Windows Server node is now joined to your Active Directory domain.
What's next
To use a Group Managed Service Account (gMSA) with your Windows Server node pools, see Using gMSA.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Configure Windows Server nodes to automatically join an Active Directory domain\n\n[Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page provides instructions to configure your [Windows Server nodes](/kubernetes-engine/docs/how-to/creating-a-cluster-windows)\nin your Google Kubernetes Engine (GKE) cluster to automatically join an Active\nDirectory (AD) domain.\n\nIf you want to join your Windows Server nodes to a\n[Managed Microsoft AD](/managed-microsoft-ad/docs/overview) domain and\ndon't require a security group that contains the computer objects of your\ncluster, you can use the automated domain join feature. For more information,\nsee [Join GKE Windows Server nodes automatically to a\nManaged Microsoft AD\ndomain](/managed-microsoft-ad/docs/automated-domain-join-gke).\n\nBefore you begin\n----------------\n\nBefore you start, make sure that you have performed the following tasks:\n\n- Enable the Google Kubernetes Engine API.\n[Enable Google Kubernetes Engine API](https://console.cloud.google.com/flows/enableapi?apiid=container.googleapis.com)\n- If you want to use the Google Cloud CLI for this task, [install](/sdk/docs/install) and then [initialize](/sdk/docs/initializing) the gcloud CLI. If you previously installed the gcloud CLI, get the latest version by running `gcloud components update`. **Note:** For existing gcloud CLI installations, make sure to set the `compute/region` [property](/sdk/docs/properties#setting_properties). If you use primarily zonal clusters, set the `compute/zone` instead. By setting a default location, you can avoid errors in the gcloud CLI like the following: `One of [--zone, --region] must be supplied: Please specify location`. You might need to specify the location in certain commands if the location of your cluster differs from the default that you set.\n\n\u003c!-- --\u003e\n\n- Ensure you have the correct IAM permission to create clusters. At minimum, you should be a [Kubernetes Engine Cluster Admin](/iam/docs/understanding-roles#kubernetes-engine-roles).\n\nConfigure auto join for Windows Server node pools\n-------------------------------------------------\n\n1. Configure AD and your Google Cloud project for automatic\n joining by completing the instructions in the\n [Configuring Active Directory for VMs to automatically join a domain](/solutions/configuring-active-directory-for-vms-to-automatically-join-the-domain)\n tutorial.\n\n2. Create a GKE cluster:\n\n gcloud container clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --enable-ip-alias \\\n --num-nodes=\u003cvar translate=\"no\"\u003eNUMBER_OF_NODES\u003c/var\u003e \\\n --no-enable-shielded-nodes \\\n --cluster-version=\u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your new cluster.\n - \u003cvar translate=\"no\"\u003eNUMBER_OF_NODES\u003c/var\u003e: the number of Linux nodes to create. You should provide sufficient compute resources to run cluster add-ons. This is an optional field and, if omitted, uses the default value of 3.\n - \u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e: the GKE cluster version, which must be 1.17.14-gke.1200 or later or 1.18.9-gke.100 or later. You can also use the [`--release-channel`](/sdk/gcloud/reference/container/clusters/create#--release-channel) flag to enroll the cluster in a release channel.\n - `--enable-ip-alias` turns on [alias IP](/vpc/docs/alias-ip). Alias IP is required for Windows Server nodes.\n - `--no-enable-shielded-nodes` disables Shielded GKE Nodes.\n3. Set the following variables:\n\n export DOMAIN_PROJECT_ID=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n export SERVERLESS_REGION=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n export REGISTER_URL=https://$SERVERLESS_REGION-$DOMAIN_PROJECT_ID.cloudfunctions.net/register-computer\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the [project ID](https://cloud.google.com/resource-manager/docs/creating-managing-projects) of your domain project.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region to [deploy your Cloud Run function](/solutions/configuring-active-directory-for-vms-to-automatically-join-the-domain) in. Choose a region that supports both [Cloud Run functions](/functions/docs/locations) and [Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access#supported_regions). The region does not have to be the same region as the one you plan to deploy VM instances in.\n4. Create and start a Windows Server node pool by passing the specialized\n scriptlet that joins the node to the AD domain:\n\n gcloud container node-pools create \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --image-type=\u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e \\\n --no-enable-autoupgrade \\\n --machine-type=\u003cvar translate=\"no\"\u003eMACHINE_TYPE_NAME\u003c/var\u003e \\\n \"--metadata=sysprep-specialize-script-ps1=iex((New-Object System.Net.WebClient).DownloadString('$REGISTER_URL'))\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNODE_POOL_NAME\u003c/var\u003e: the name of your Windows Server node pool.\n - \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of the cluster you created.\n - \u003cvar translate=\"no\"\u003eIMAGE_NAME\u003c/var\u003e: the node image to use, such as `WINDOWS_LTSC_CONTAINERD`. For more information, see [Choose your Windows Server node image](/kubernetes-engine/docs/how-to/creating-a-cluster-windows#choose_your_windows_server_node_image).\n - \u003cvar translate=\"no\"\u003eMACHINE_TYPE_NAME\u003c/var\u003e: the machine type. `n1-standard-2` is the minimum recommended machine type as Windows Server nodes require additional resources. Machine types `f1-micro` and `g1-small` are not supported. Each machine type is billed differently. For more information, refer to the [machine type price sheet](/compute/pricing#standard_machine_types).\n\nYour Windows Server node is now joined to your Active Directory domain.\n\nWhat's next\n-----------\n\n- To use a Group Managed Service Account (gMSA) with your Windows Server node pools, see [Using gMSA](/kubernetes-engine/docs/how-to/creating-a-cluster-windows#using_gmsa).\n- Learn about the [Managed Service for Microsoft Active Directory](/managed-microsoft-ad/docs/overview)."]]