Error Description
When I try to join a new Windows workstation or server to an Active Directory (AD) domain, I sometimes encounter the following error: “An Active Directory Domain Controller (AD DC) for the domain ‘domainname’ could not be contacted.”
This error can occur due to any of several reasons, from a simple incorrect DNS server IP address to a much more complex issue. In this blog, I will walk you through the steps you need to troubleshoot this problem, from the simplest to the most complex.
When the Error Arises
The error can be displayed when you attempt to join a workstation or server to a domain. Here are the steps that lead up to the error:
- Right-click on the Start button and select System:
- On the next screen, click Change settings:
- In the System Properties window, click the Change button. Then enter the name of the new computer and specify which domain you want to join it to, being sure to enter the FQDN (fully qualified domain name) of the domain. Click OK. This is when the error might be displayed:
Initial Troubleshooting Steps
First, ensure that you typed the domain name correctly.
If that’s not the problem, click Details to get information about the error.
The following sections detail the steps to take to get to the root of the problem. In most cases, the issue is related to one of the following: incorrect DNS settings or a wrong IP address on your system, DNS misconfiguration on the domain controller (DC) side, or ports that are blocked on the firewall.
If you do not know the root of the problem, I suggest proceeding through these troubleshooting options in order. However, if you have additional information, feel free to proceed directly to the step that you think is likely to solve the problem.
Verify that the IP Settings are Correct
Make sure that the network interface of your computer has the right IP address. The IP address can be explicitly defined in the network adapter settings or can be obtained from a DHCP server. To get the computer’s current network settings, use this command:
ipconfig /all
Make sure the DNS Client Service is Running
Next, check whether the DNS client service is up and running using this command:
Get-Service dnscache
Check the Host File for Domain Entries
Make sure there are no entries for your domain or domain controller names in the hosts file located at C:\Windows\System32\Drivers\etc\hosts on the PC. Open the file with Notepad or any other text editor. If there are any entries for your domain or DC names, delete them.
To view the contents of the hosts file on the PC, use this command:
get-content C:\Windows\System32\Drivers\etc\hosts
Restart the DNS Cache Service
Open an elevated command prompt and clear the DNS cache using this command:
ipconfig /flushdnsThen stop and restart the dnscache service using this command:
net stop dnscache && net start dnscache
Alternatively, you can use the Service.msc console. Right-click on DNS Client to open its properties dialog:
Click use the Stop and Start buttons to stop and restart the service:
Check whether the DC is Reachable from the Client
To determine whether the domain controller is reachable from the client, first run the following commands from a command prompt:
ping your_domain_name.com
Then run this command:
tracert your_domain_name.com
You should also check the availability of the DC from another workstation on the same network. If your client cannot access the DC but other clients can, there could be a problem with your client’s cable or hardware, or with a device in the middle. To narrow down the problem, try a different network jack or go wireless.
Check the DC’s Accessibility using PowerShell
Alternatively, you can use the following PowerShell cmdlets to check the connectivity to the DC.
To display the IP address:
Get-NetIPConfiguration –All
To ping the DC:
Test-NetConnection domainname
To trace the routes to the DC:
Test-NetConnection –TraceRoute domainname
Add the DNS server to the TCP/IP settings of your Network Adapter
If the domain controller can be reached, try adding the IP address of your DNS server to your network adapter’s Advanced TCP/IP settings.
- Open Control Panel, click Network and Sharing Center, and then click Change adapter settings:
- Right-click on the network adapter and select Properties.
- Right-click on Internet Protocol Version 4 (TCP/IPv4) and choose Properties.
- Click the Advanced button and go to the DNS tab.
- On the DNS tab, click the Add button, provide the IP address of your DNS server and click OK. (Note that the DNS server might be a DC, especially if it’s a small organization.)
- If multiple IP addresses are listed, use the arrow buttons to move your preferred one to the top of the list. Then click OK.
- Click OK again to save your changes.
- Restart the workstation or server so the changes will take effect, and try again to join the workstation or server to the Active Directory domain.
Check whether you’re using the Right DNS servers
Before you go too deep down the rabbit hole, double-check that you are using the correct DNS servers. Specifically, the DNS servers that DCs are aware of are used to register records that help AD-connected devices locate resources like DCs; DNS servers that are not AD-integrated do not have these records.
According, make sure you are using one of the following:
- A DNS server with Active Directory integration
- A DNS server that replicates records from another DNS server that is aware of Active Directory
- A DNS server configured to query either an AD-integrated DNS server or a DNS server with duplicated records via forwarding
To check that your DNS server is one of these, use the PowerShell cmdlet shown below in a PowerShell session on a domain-joined PC. (If you don’t have another domain client to use, you will need to contact your network staff.)
Get-DnsClientServerAddress
The DNS servers used by the computer running the cmdlet are listed in the ServerAddesses column.
Option 1: Update the Computer’s DNS Client Settings
If you need to update the computer’s DNS client settings, you can use the following cmdlet:
Set-DnsClientServerAddressAlternatively, you can use the IPv4 Properties dialog box for the computer’s network card: Go to Control Panel –> Network –> Internet –> Network Connections. Then right-click on the network card, select Properties and then Internet Protocol Version 4 (TCP/IPv4), and then Properties. Review the settings:
If the network supports Dynamic Host Configuration Protocol (DHCP), ensure that both the Obtain an IP address automatically and Obtain DNS server address automatically boxes are checked.
If your network does not use DHCP, change the values for Preferred DNS server and Alternative DNS server to the ones you found previously (when you ran the Set-DnsClientServerAddress cmdlet).
Option 2: Connect to the Domain through Windows Settings
Another option is to connect to the domain through Windows Settings:
- Press the Windows and I keys on your keyboard to open the Window Settings window.
- Click Accounts.
- In the left menu, click Access work or school. Then click Connect.
- At the bottom of the Microsoft account window, click Join this device to a local Active Directory domain.
- Provide a valid, contactable domain name and click Next.
- Next, provide a domain account to use for joining this workstation to a domain. This account must have the permissions to join a workstation to a domain. Click OK.
- If you do not get an error, your workstation is now joined with the domain. On the next screen, provide a user account for this PC and then click Next.
- Click Restart so your changes will take effect.
Check whether a Firewall is blocking port 53 on the DC
Check whether the DNS service on the DC is being blocked by a firewall. To see whether port 53 is available on the DC, use this cmdlet:
test-netconnection 172.168.5.160 -port 53Check the value of “TcpTestSucceeded”. A value of “True” as shown below indicates that the DNS service on the DC is operational.
Check whether your Computer can resolve the Domain Name of the DC
Next, check whether the workstation can accurately resolve the domain name to the DC’s IP address. Use the fully qualified domain name of the domain to which you are trying to join your workstation with the Resolve-DNSName cmdlet, as shown here:
Resolve-DNSName fabrikam.local
This command should return one or more DNS server records.
Check whether the Workstation can Contact the DNS server that hosts the DNS zone
Next, check whether:
- The computer can communicate with the DNS server that hosts the DNS zone or resolves DNS names for the domain.
- The DNS server for the client is configured correctly and that it is connected to it.
- You can find a domain and connect to the DC from your computer.
To get the domain and DC information, along with the IP address, use the following cmdlet:
nltest /dsgetdc:fabrikam.local
If the command completes successfully, it will return information like the following:
DC: \\FRGC1.fabrikam.local
Address: \\10.20.6.41
Dom Guid: c64586c9-2c18-4fc4-9fe1-18f2a262d90d
Dom Name: fabrikam.local
Forest Name: fabrikam.local
Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10
The command completed successfully
Restart the Netlogon Service on the Domain Controller
Restart the Netlogon service on the DC using this command:
net stop netlogon && net start netlogon
Alternatively, simply reboot the DC.
When the server restarts, it will try to register the necessary SRV records on the DNS server.
Re-register the DC’s DNS records
Re-register the DC’s DNS records by running this command:
ipconfig /registerdns
Wait for the records to arrive in DNS and for them to propagate across the domain.
Since 2012, Jonathan Blackwell, an engineer and innovator, has provided engineering leadership that has put Netwrix GroupID at the forefront of group and user management for Active Directory and Azure AD environments. His experience in development, marketing, and sales allows Jonathan to fully understand the Identity market and how buyers think.
Previously, we shared you the guide to join Windows 10 to a domain. Now in this article, we’ll see what to do, in case if you cannot join to a domain using our shared guide. While joining to a domain, you might see this message and you can’t proceed further:
Page Contents
That domain couldn’t be found. Check the domain name and try again.
So if you’re also facing this issue on your system, here is how to resolve. First of all, ensure that you’ve correct domain name. Also make sure, you’ve correctly changed the network adapter settings to point to DNS server of your domain.
FIX: Cannot Join Domain In Windows 10
FIX 1 – Via System Properties
Try to join to a domain using older Control Panel method. Sometimes (not always) the Settings UI method fails but this works.
1. Press + R and type SYSDM.CPL in Run. Click OK or press Enter key.
2. In System Properties window, under Computer Name tab, click on Change button.
3. In Computer Name/Domain Changes window, change Member of to Domain. Then type fully qualified domain name (FQDN) and click OK.
Note: To find FQDN, you need to contact your domain or IT administrator. As an IT admin, you can find FQDN by running echo %userdnsdomain% command on domain controller.
If issue still persists, check FIX 2 mentioned below.
FIX 2 – Using Registry
Usually, clients on Windows 10 will use DNS to check if the single-label domain name exists in their local forest. To check or query the single-label domain name in either local forest or remote one, you need configure the registry settings described below.
Registry Disclaimer: The further steps will involve registry manipulation. Making mistakes while manipulating registry could affect your system adversely. So be careful while editing registry entries and create a System Restore point first.
1. Run regedit command to open Registry Editor.
2. In left pane of Registry Editor window, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.
3. In right pane of Parameters key, create a new registry DWORD (REG_DWORD) named AllowSingleLabelDnsDomain and set it to 1.
4. Close Registry Editor and reboot.
FIX 3 – Other Suggestions
1. Make sure you restart the system after configuring network adapter settings and then try to join domain.
2. Ensure you use the DNS name or FQDN and not the NetBIOS name.
3. You need to clear all connections to mapped drive before you join to a domain. This could be one of the common reason you failed to join domain.
4. Update the network drivers to latest version on the workstation you failed to join to a domain.
5. Refer FIX 2 mentioned in this article and enable NetBIOS over TCP/IP.
In case if you still face the issue, drop us a comment!
RELATED ARTICLES
Распознавание голоса и речи на C#
UnmanagedCoder 05.05.2025
Интеграция голосового управления в приложения на C# стала намного доступнее благодаря развитию специализированных библиотек и API. При этом многие разработчики до сих пор считают голосовое управление. . .
Реализация своих итераторов в C++
NullReferenced 05.05.2025
Итераторы в C++ — это абстракция, которая связывает весь экосистему Стандартной Библиотеки Шаблонов (STL) в единое целое, позволяя алгоритмам работать с разнородными структурами данных без знания их. . .
Разработка собственного фреймворка для тестирования в C#
UnmanagedCoder 04.05.2025
C# довольно богат готовыми решениями – NUnit, xUnit, MSTest уже давно стали своеобразными динозаврами индустрии. Однако, как и любой динозавр, они не всегда могут протиснуться в узкие коридоры. . .
Распределенная трассировка в Java с помощью OpenTelemetry
Javaican 04.05.2025
Микросервисная архитектура стала краеугольным камнем современной разработки, но вместе с ней пришла и головная боль, знакомая многим — отслеживание прохождения запросов через лабиринт взаимосвязанных. . .
Шаблоны обнаружения сервисов в Kubernetes
Mr. Docker 04.05.2025
Современные Kubernetes-инфраструктуры сталкиваются с серьёзными вызовами. Развертывание в нескольких регионах и облаках одновременно, необходимость обеспечения низкой задержки для глобально. . .
Создаем SPA на C# и Blazor
stackOverflow 04.05.2025
Мир веб-разработки за последние десять лет претерпел коллосальные изменения. Переход от традиционных многостраничных сайтов к одностраничным приложениям (Single Page Applications, SPA) — это. . .
Реализация шаблонов проектирования GoF на C++
NullReferenced 04.05.2025
«Банда четырёх» (Gang of Four или GoF) — Эрих Гамма, Ричард Хелм, Ральф Джонсон и Джон Влиссидес — в 1994 году сформировали канон шаблонов, который выдержал проверку временем. И хотя C++ претерпел. . .
C# и сети: Сокеты, gRPC и SignalR
UnmanagedCoder 04.05.2025
Сетевые технологии не стоят на месте, а вместе с ними эволюционируют и инструменты разработки. В . NET появилось множество решений — от низкоуровневых сокетов, позволяющих управлять каждым байтом. . .
Создание микросервисов с Domain-Driven Design
ArchitectMsa 04.05.2025
Архитектура микросервисов за последние годы превратилась в мощный архитектурный подход, который позволяет разрабатывать гибкие, масштабируемые и устойчивые системы. А если добавить сюда ещё и. . .
Многопоточность в C++: Современные техники C++26
bytestream 04.05.2025
C++ долго жил по принципу «один поток — одна задача» — как старательный солдатик, выполняющий команды одну за другой. В то время, когда процессоры уже обзавелись несколькими ядрами, этот подход стал. . .
When trying to join a Windows computer to an AD domain, you may receive the error “An Active Directory Domain Controller could not be contacted“. The client may be unable to connect to the domain controller due to incorrect network settings (IP, DNS or firewall) or a domain controller failure. This guide explains how to troubleshoot and fix this domain controller connectivity issue.
Troubleshooting AD Domain Controller Connectivity
When a computer joining the Active Directory, it should discover and connect to the domain controller (DC). The error occurs if the client is unable to connect the DC:
An Active Directory Domain Controller (AD DC) for the domain “theitbros.com” could not be contacted. Ensure that the domain name is typed correctly.
Click the Details button to view the detailed error description. The most common errors are:
- 0x0000232B — RCODE_NAME_ERROR (“DNS name does not exist”).
- 0x0000267C — DNS_ERROR_NO_DNS_SERVER (“No DNS Servers configured for local system”).
- 0x00002746 — WSAECONNRESET (“An existing connection was forcibly closed by the remote host”).
- 0x000005B4 — ERROR_TIMEOUT (“This operation returned because the timeout period expired”). The DNS servers used by this computer for name resolution are not responding.
Here are the basic checks you should perform to troubleshoot the issue:
- Make sure you’ve not mistyped in Active Directory domain name;
- Check the client IP and DNS settings;
- Verify the network connectivity to the DC;
- Check the DC health.
Let’s look at each of these steps in more detail.
Check the Network Connectivity to the AD Domain Controller from Client
The client Windows machine can connect the Active Directory if it has properly configured IP address and preferred DNS server set. Open the PowerShell console to perform basic network connection troubleshooting.
Try to resolve the Active Directory domain name to an IP address:
Resolve-DnsName theitbros.loc
If the “DNS name does not exist” error occurs, check the DNS server IP addresses set on the computer. List the client DNS configuration using the command:
Get-DnsClientServerAddress
The IP address of one of the AD domain controllers must be specified as the DNS server in this list on the client computer. If the public (such as 8.8.8.8 or 1.1.1.1) or non-existent DNS server IP is specified here, change the preferred DNS server in the network adapter properties (ncpa.cpl > Network Adapter Properties > IPv4 Properties > Manually set your DC’s IP address as preferred DNS).
Ensure that there are no manually entered (static) entries in the hosts file for your domain or domain controller names. If there are any such entries, delete them.
get-content C:\Windows\System32\Drivers\etc\hosts
Then clear the DNS resolver cache on the computer:
ipconfig /flushdns
Check you can ping the DC by an IP address:
ping 192.168.158.100
If the destination IP is unreachable, check that the computer’s IP address belongs to your AD network:
- If the computer obtains network configuration from a DHCP server, try to renew the IP settings with the commands:
ipconfig /release ipconfig /renew
- If you have a static IP address, contact your network administrator to check your current configuration.
After configuring the client’s network settings correctly, make sure you are able to resolve the AD name.
Resolve-DnsName theitbros.loc
Ping the domain:
ping theitbros.loc
And discover the AD services in the domain (according the Active Directory sites and services configuration):
nltest /dsgetdc:theitbros.loc
Hint. Another helpful guide that can help you troubleshoot DC connectivity over RPC is “1722 The RPC server is unavailable”.
In some cases, firewalls can block the communication ports between the client computer and the DC. To successfully join the Active Directory domain, the following network ports must be opened in the firewall.
- UDP 53 — DNS traffic;
- TCP and UDP 88 — Kerberos authentication;
- UDP 123 — Windows Sync time with Domain Controller;
- TCP 135 — Remote Procedure Call RPC Locator;
- TCP and UDP 139 — NetBIOS Session Service;
- TCP and UDP 389 (LDAP, DC Locator, Net Logon) or TCP 636 (LDAP over SSL);
- TCP 445 – (SMB/CIFS, Net Logon);
- TCP 49152-65535 — RPC ports, randomly allocated high TCP ports.
You can use PowerShell to check for open ports. For example, check for open DNS service port 53
Test-Netconnection 192.168.1.11 -port 53
TcpTestSucceeded: True
Check for Service DNS Records in Active Directory
If the previous checks haven’t resolved the connection error to the domain controller, and similar issues persist on other devices, it’s crucial to inspect the DNS configuration in Active Directory.
Clients discover the AD controllers using the special SRV records in the Active Directory DNS zone. If such SRV records are missing, the client will not be able to contact the DC.
Run the following commands to query the LDAP SRV record:
nslookup set type=all _ldap._tcp.dc.msdcs.your_domain_name.com
Check that the specified DNS server has an SRV record of the following form:
_ldap._tcp.dc._msdcs.your_domain_name.com SRV service location:
The following two DNS records (SRV and A) used clients to discover the domain controller’s IP address:
- _ldap._tcp.dc._msdcs.your_domain_name.com — is an SRV resource record that points to the domain controller;
- Resource A record that identifies the IP address for the DC listed in the _ldap.tcp.dc._msdcs.your_domain_name.com SRV resource record.
You can recreate the DNS record manually using the DNS manager snap-in (dnsmgmt.msc) or run the following command on the DC to recreate SRV and A records automatically:
net stop netlogon && net start netlogon ipconfig /registerdns
Be patient for a while to allow the records to appear in the DNS and replicate across the domain.
Then check the AD health using the dcdiag command:
dcdiag /a /q
Resolve any AD errors you’ve found. After that, you can try to join the Windows workstation to the domain.
Cyril Kardashevsky
I enjoy technology and developing websites. Since 2012 I’m running a few of my own websites, and share useful content on gadgets, PC administration and website promotion.
Причиной ошибки “The specified domain either does not exist or could not be contacted/ Указанный домен не существует, или к нему невозможно подключиться” в Windows чаще всего являются некорректные сетевые настройки (IP адрес, DNS сервера, шлюз по умолчанию) на клиентском компьютере, в результате чего компьютер не может подключиться к контроллеру домена Active Directory и выполнить аутентификацию.
Содержание:
- Ошибка: “Указанный домен не существует” при добавлении компьютера в Active Directory
- «Указанный домен не существует» при входе в Windows
Ошибка: “Указанный домен не существует” при добавлении компьютера в Active Directory
При попытке добавить компьютер Windows в домен Active Directory может появится ошибка:
The following error occurred attempting to join the domain WINITPRO. The specified domain either does not exist or could not be contacted.
Это означает, что с этого компьютера не доступен указанный домен AD. Причина может быть в некорректном IP адресе компьютера или неверных настройках DNS, в результате чего Windows не может отрезвить IP адрес контроллера домена по его DNS имени.
Вам нужно:
- Проверить корректность работы сети на компьютере и его сетевые настройки
- Проверьте корректность работы DNS
Проверьте, что ваш компьютер получил корректные сетевые настройки IP от DHCP сервера. Выведите сетевые настройки вашего подключения с помощью команды:
ipconfig /all
Можно узнать настройки сетевого интерфейса с помощью PowerShell:
Get-NetAdapter -Physical | ? {$_.Status -eq "Up"} | Get-NetIPConfiguration
Проверьте, что на вашем компьютере задан корректный IP адрес из вашего сегмента сети.
Попробуйте обновить IP адрес:
ipconfig/release
ipconfig/release6
ipconfig/renew
Проверьте доступность DNS сервера:
Test-NetConnection 192.168.13.10
Test-NetConnection 192.168.13.10 -Port 53
В этом примере DNS сервер доступен по ICMP (
PingSucceeded:true
) и на нем открыт DNS порт (
TcpTestSucceeded:True
).
Проверьте, что данный DNS сервер может разрешить имя домена в IP адрес:
nslookup winitpro.ru
Проверьте, что в вашем локальном файле hosts отсутствует ручные записи для вашего домена:
Get-Content -Path "C:\Windows\System32\drivers\etc\hosts"
Если в настройках сетевого интерфейса указан неверный IP адрес вашего DNS сервера или он не доступен, вы можете задать его вручную через панель управления сетевыми подключениями. Откройте панель ncpa.cpl -> свойства сетевого адапретера -> свойства TCP/IPv4 -> Preffered DNS server. Задайте здесь IP адрес вашего ближайшего контроллера домена AD.
Очистите DNS кэш:
ipconfig /flushdns
net stop dnscache
net start dnscache
Если этого не сработало, нужно дополнительно нажать на кнопку Advanced:
- На вкладке DNS включите опцию Use this connection’s DNS suffix in DNS registration и вручную укажите имя домена в DNS suffix for this connection;
- Затем на вкладке WINS вручную добавьте IP адрес вашего DC.
В некоторых случаях помогает отключение протокола IPv6 на сетевом интерфейсе.
Попробуйте теперь выполнить обнаружение контроллеров домена в DNS:
nltest /dnsgetdc:winitpro.ru
И возможность подключения к контроллеру домена в вашем сайте:
nltest /dsgetdc:winitpro.ru
Попробуйте еще раз добавить компьютер в домен AD.
«Указанный домен не существует» при входе в Windows
Ошибка “Указанный домен не существует, или к нему невозможно подключиться” может появится при попытке входа в Windows под доменной учетной записью.
Эта ошибка может указывать на то:
- Недоступность контроллера домена с компьютера (неверные сетевые настройки в Windows);
- Если проблема проявляется на нескольких компьютерах, возможно это указывает на ошибки в работе контролера домена.
Если проблема возникла на одном компьютер, попробуйте войти под локальной учетной записью (укажите имя .\administrator на экране входа в Windows). Если вы не знаете пароль локального администратора, можно сбросить его. Проверьте корректность сетевых настроек компьютера, доступность DNS сервера и контроллера домена. Исправьте настройки IP вручную, если нужно.
Если проблема возникает на нескольких компьютерах, проверьте что на вашем контроллере домена (Logon сервере) запушена служба NetLogon:
Проверьте что на DC опубликованы сетевые папки SYSVOL и NETLOGON. Если они отсуствууют, измените значение параметра реестра SysvolReady с 0 на 1 в ветке HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters и перезапустите службу NetLogon.
Выполните диагностику контроллеров домена и репликации с помощью команд
dcdiag
и
repadmin
.