A domain-joined workstation is a Windows computer that belongs to an enterprise Active Directory domain. It receives centralized authentication, policy, software deployment, and monitoring from domain controllers and management tools, rather than being managed only as a standalone machine.
This matters in cyber security because a domain-joined endpoint can give attackers access to shared credentials, mapped resources, and enterprise trust relationships. Once compromised, it may be used to move laterally, harvest tokens, or blend in with normal administrative traffic. Defenders also benefit from the same central control: they can enforce hardening, collect logs, and detect unusual changes such as unexpected WMI persistence, hidden files, or suspicious local administrator activity. In practice, a malware sample on a domain-joined workstation is often more concerning than the same sample on an isolated PC, because it may be operating inside a monitored corporate environment with broader reach.