看起来可能有一些设置可以帮助解决这个问题，请参见here，可能所有需要的可能是："EnableCredSspSupport": "true"在您的domjoin设置块中。
您可能还需要对服务器端的注册表执行一些操作，这可以通过使用remote-exec来完成。
例如：

resource "azurerm_windows_virtual_machine" "example" {
  name                  = "example-vm"
  location              = azurerm_resource_group.example.location
  resource_group_name   = azurerm_resource_group.example.name
  network_interface_ids = [azurerm_network_interface.example.id]
  vm_size               = "Standard_DS1_v2"

  storage_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2019-Datacenter"
    version   = "latest"
  }

  storage_os_disk {
    name              = "example-os-disk"
    caching           = "ReadWrite"
    create_option     = "FromImage"
    managed_disk_type = "Standard_LRS"
  }

  os_profile {
    computer_name  = "example-vm"
    admin_username = "adminuser"
    admin_password = "SuperSecurePassword1234!"
  }

  os_profile_windows_config {
    provision_vm_agent = true
  }

  provisioner "remote-exec" {
    inline = [
      "echo Updating Windows...",
      "powershell.exe -Command \"& {Get-WindowsUpdate -Install}\"",
      "echo Done updating Windows."
    ]

    connection {
      type        = "winrm"
      user        = "adminuser"
      password    = "SuperSecurePassword1234!"
      timeout     = "30m"
    }
  }
}

为了在注册表中设置正确的键，您可能需要在remote-exec块中使用类似下面的代码（我还没有验证这段代码）：

Set-ItemProperty -Path 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-tcp' -Name 'SecurityLayer' -Value 0

为了使Terraform配置更简洁，我建议使用Powershell脚本的模板，请参见here
希望这能帮上忙