Dell VNX/Unity: Domain Join Fails with Error 13157007728 Unable set account attribute for compname

There may be various reasons for this error.
Most notably, the user account used for the domain join might be able to create a computer account but not modify it.

A customer is unable to perform a domain join operation with any known standard flags.
The join command is failing with the following error:

Error 13157007728: server_2 : DomainJoin::reuseAccount: Unable set account attribute for compname 'CIFS01' to domain 'DOM.Domain.NET' on Active Directory server 'dc2.dom.domain.net' using CIFS server credential. Distinguished name is 'CN=cifs01,OU=Computers,OU=EMC Celerra,DC=DOM,DC=domain,DC=net'.

server_cifs is showing unjoined:

CIFS Server 02CIFSSERVER[DOM] RC=160 (local users supported)
 Full computer name=02cifs01.dom.domain.net realm=DOM.DOMAIN.NET (domain not joined !)
 Comment='EMC-SNAS:T7.1.83.2'
 if=02CIFS01 l=10.xxx.xx.x b=10.xxx.xx.xx mac=0:00:00:00:00:00
  FQDN=02cifs01.dom.diomain.net (Retrying DNS update...)
 Password change interval: 43140 minutes

The computer account was unjoined from the domain, but there are no clear indications on the NAS cmd_log that this was performed on the NAS side.

Method for forcing the rejoin operation:

1. Ensure that the account has sufficient rights to perform this operation.
2. Check whether the computer account exists in Active Directory. - See nas_message instructions in notes.
3. Trying to perform a rejoin with options may not work either [-option {reuse|resetserverpasswd|addservice=nfs}] and fail with an account does not exist in AD.
4. Ensure that the compname matches the netbios name. In one particular scenario, the netbios was set differently historically.

In order to force dns domain registration, the following param was applied:

nasadmin@vnxcs01 ~]$ server_param server_2 -facility cifs -info djEnforceDhn
server_2 :
name                    = djEnforceDhn
facility_name           = cifs
default_value           = 1
current_value           = 1
configured_value        =
user_action             = none
change_effective        = immediate
range                   = (0,1)
description             = Enforces the setting of the dNSHostName attribute
[nasadmin@vnxcs01 ~]$ server_param server_2 -facility cifs -modify djEnforceDhn -value 0
server_2 : done
[nasadmin@vnxcs01 ~]$ server_param server_2 -facility cifs -info djEnforceDhn
server_2 :
name                    = djEnforceDhn
facility_name           = cifs
default_value           = 1
current_value           = 0
configured_value        = 0
user_action             = none
change_effective        = immediate
range                   = (0,1)
description             = Enforces the setting of the dNSHostName attribute
[nasadmin@vnxcs01 ~]$

Retry a simple join again without any special flags.

$  nas_message -i 13157007728
MessageID = 13157007728
BaseID    = 368
Severity  = ERROR
Component = DART
Facility  = SMB
Type      = STATUS

Brief_Description  = ${function0,8,%s}: Unable set ${objectName4,8,%s} for compname '${serverName1,8,%s}' to domain '${domainName3,8,%s}' on Active Directory server '${DCName2,8,%s}' using CIFS server credential. Distinguished name is '${distinguishedName5,8,%s}'.

Full_Description   = ${function0,8,%s}: Unable set ${objectName4,8,%s} for compname '${serverName1,8,%s}' to domain '${domainName3,8,%s}' on Active Directory server '${DCName2,8,%s}' using CIFS server credential. Distinguished name is '${distinguishedName5,8,%s}'. This error might occur when the compnuter account already exist in Active Directory (after manual creation for example).

Recommended_Action = Check whether computer account exists in Active Directory.

Param Clarification:

• djEnforceDhn:- When joining a CIFS server to a domain, the join process sets the account attribute dNSHostName to the server's DNS hostname.
• 0 = Allow the domain join process to continue without setting the account attribute dNSHostName.
• 1 = Set the account attribute dNSHostName to the server's DNS hostname. If the domain join process is unable to set the attribute, the operation fails and a notification is sent. In certain domain configurations, the domain join process is unable to set the account attribute because of access rights.