diff --git a/lib/ansible/modules/windows/win_domain_membership.ps1 b/lib/ansible/modules/windows/win_domain_membership.ps1
index d19aa46d5c7..28daeb00a5a 100644
--- a/lib/ansible/modules/windows/win_domain_membership.ps1
+++ b/lib/ansible/modules/windows/win_domain_membership.ps1
@@ -125,7 +125,11 @@ Function Join-Domain {
     }
     $argstr = $add_args | Out-String
     Write-DebugLog "calling Add-Computer with args: $argstr"
-    $add_result = Add-Computer @add_args
+    try {
+        $add_result = Add-Computer @add_args
+    } catch {
+        Fail-Json -obj $result -message "failed to join domain: $($_.Exception.Message)"
+    }
 
     Write-DebugLog ("Add-Computer result was \n{0}" -f $add_result | Out-String)
 }
@@ -140,8 +144,16 @@ Function Set-Workgroup {
     )
 
     Write-DebugLog ("Calling JoinDomainOrWorkgroup with workgroup {0}" -f $workgroup_name)
+    try {
+        $swg_result = (Get-WmiObject -ClassName Win32_ComputerSystem).JoinDomainOrWorkgroup($workgroup_name)
+    } catch {
+        Fail-Json -obj $result -message "failed to call Win32_ComputerSystem.JoinDomainOrWorkgroup($workgroup_name): $($_.Exception.Message)"
+    }
 
-    return (Get-WmiObject Win32_ComputerSystem).JoinDomainOrWorkgroup($workgroup_name)
+    if ($swg_result.ReturnValue -ne 0) {
+        Fail-Json -obj $result -message "failed to set workgroup through WMI, return value: $($swg_result.ReturnValue)"
+    
+    return $swg_result}
 }
 
 Function Join-Workgroup {
@@ -155,7 +167,11 @@ Function Join-Workgroup {
         $domain_cred = Create-Credential $domain_admin_user $domain_admin_password
 
         # 2012+ call the Workgroup arg WorkgroupName, but seem to accept
-        $rc_result = Remove-Computer -Workgroup $workgroup_name -Credential $domain_cred -Force
+        try {
+            $rc_result = Remove-Computer -Workgroup $workgroup_name -Credential $domain_cred -Force
+        } catch {
+            Fail-Json -obj $result -message "failed to remove computer from domain: $($_.Exception.Message)"
+        }
     }
 
     # we're already on a workgroup- change it.
diff --git a/test/integration/targets/win_domain_membership/aliases b/test/integration/targets/win_domain_membership/aliases
new file mode 100644
index 00000000000..ee0ed5974e9
--- /dev/null
+++ b/test/integration/targets/win_domain_membership/aliases
@@ -0,0 +1 @@
+windows/ci/group2
diff --git a/test/integration/targets/win_domain_membership/tasks/main.yml b/test/integration/targets/win_domain_membership/tasks/main.yml
new file mode 100644
index 00000000000..c6294bd32a6
--- /dev/null
+++ b/test/integration/targets/win_domain_membership/tasks/main.yml
@@ -0,0 +1,20 @@
+---
+- name: get current workgroup
+  win_shell: (Get-WmiObject Win32_ComputerSystem).Workgroup
+  register: workgroup
+
+- name: fail if workgroup result is empty (means test host is in a domain)
+  fail:
+    msg: Cannot run tests for win_domain_membership when host is a member of a domain
+  when: workgroup.stdout == ""
+
+- block:
+  - include_tasks: tests.yml
+
+  always:
+  - name: revert workgroup back to original before tests
+    win_domain_membership:
+      workgroup_name: '{{workgroup.stdout_lines[0]}}'
+      state: workgroup
+      domain_admin_user: fake user
+      domain_admin_password: fake password
diff --git a/test/integration/targets/win_domain_membership/tasks/tests.yml b/test/integration/targets/win_domain_membership/tasks/tests.yml
new file mode 100644
index 00000000000..4b1cf62a4a8
--- /dev/null
+++ b/test/integration/targets/win_domain_membership/tasks/tests.yml
@@ -0,0 +1,59 @@
+---
+- name: change workgroup (check mode)
+  win_domain_membership:
+    workgroup_name: ANSIBLETEST
+    state: workgroup
+    domain_admin_user: fake user
+    domain_admin_password: fake password
+  register: change_workgroup_check
+  check_mode: yes
+
+- name: get result of change workgroup (check mode)
+  win_shell: (Get-WmiObject Win32_ComputerSystem).Workgroup
+  register: change_workgroup_result_check
+
+- name: assert result of change workgroup (check mode)
+  assert:
+    that:
+    - change_workgroup_check|changed
+    - change_workgroup_result_check.stdout == workgroup.stdout
+
+- name: change workgroup
+  win_domain_membership:
+    workgroup_name: ANSIBLETEST
+    state: workgroup
+    domain_admin_user: fake user
+    domain_admin_password: fake password
+  register: change_workgroup
+
+- name: get result of change workgroup
+  win_shell: (Get-WmiObject Win32_ComputerSystem).Workgroup
+  register: change_workgroup_result
+
+- name: assert result of change workgroup
+  assert:
+    that:
+    - change_workgroup|changed
+    - change_workgroup_result.stdout_lines[0] == "ANSIBLETEST"
+
+- name: change workgroup (idempotent)
+  win_domain_membership:
+    workgroup_name: ANSIBLETEST
+    state: workgroup
+    domain_admin_user: fake user
+    domain_admin_password: fake password
+  register: change_workgroup_again
+
+- name: assert result of change workgroup (idempotent)
+  assert:
+    that:
+    - not change_workgroup_again|changed
+
+- name: change workgroup fail invalid name
+  win_domain_membership:
+    workgroup_name: ANSIBLELONGNAMEFAILURE
+    state: workgroup
+    domain_admin_user: fake user
+    domain_admin_password: fake password
+  register: fail_change_workgroup
+  failed_when: "fail_change_workgroup.msg != 'failed to set workgroup through WMI, return value: 2695'"