--- title: "Fix 'An Active Directory Domain Controller Could Not Be Contacted'" description: "Resolve the 'An Active Directory Domain Controller Could Not Be Contacted' error once and for all." canonical: "https://adamtheautomator.com/an-active-directory-domain-controller-could-not-be-contacted/" --- # Fix 'An Active Directory Domain Controller Could Not Be Contacted' > Resolve the 'An Active Directory Domain Controller Could Not Be Contacted' error once and for all. Source: https://adamtheautomator.com/an-active-directory-domain-controller-could-not-be-contacted/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Fix 'An Active Directory Domain Controller Could Not Be Contacted'](https://adamtheautomator.com/wp-content/uploads/2019/08/active-directory-domain-error.jpg) # Fix 'An Active Directory Domain Controller Could Not Be Contacted' [![](https://secure.gravatar.com/avatar/995fcc2faf7fc9d3f15061d8e6c5b84f4b751d96502ef7afb4f9f648a58b36a4?s=192&d=mm&r=g)Stuart Squibb](https://adamtheautomator.com/author/stuart/)27 August 20197 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/) Table of Contents * [Ensure You’re Using the Right DNS Servers](#ensure-you-re-using-the-right-dns-servers) * [Find the True Error](#find-the-true-error) * [0x0000267C DNS\_ERROR\_NO\_DNS\_SERVER](#0x0000267c-dns_error_no_dns_server) * [Troubleshoot Your Network Connection](#troubleshoot-your-network-connection) * [Check DNS connectivity](#check-dns-connectivity) * [0x0000232B RCODE\_NAME\_ERROR](#0x0000232b-rcode_name_error) * [Ensure You’re Using the Domain FQDN](#ensure-you-re-using-the-domain-fqdn) * [Check DNS records](#check-dns-records) * [Summary](#summary) * [Further Reading](#further-reading) Every IT admin managing machines in an Active Directory environment has been there. You try to add a computer to an Active Directory (AD) domain and get the dreaded “_An Active Directory Domain Controller Could not be Contacted”_ error. In this article, learn the steps to diagnose (and solve) this problem for good. > _A FREE read only tool that scans your AD and generates multiple interactive reports for you to measure the effectiveness of your password policies against a brute-force attack. [Download Specops Password Auditor now!](https://specopssoft.com/product/specops-password-auditor/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention)_ ![An Active Directory Domain Controller Could not be Contacted](/wp-content/uploads/2019/08/active-directory-domain-controller-could-not-be-contacted-1.png "image_tooltip") An Active Directory Domain Controller Could not be Contacted This error is DNS-related. The main problem is that the computer has failed to find an appropriate SRV [DNS record](https://adamtheautomator.com/powershell-dns/ "DNS record") it needs to join the AD domain. I’ve put together a few steps for you to follow to fix this error and get your computer joined to your domain. ## Ensure You’re Using the Right DNS Servers Before you get too far down a rabbit hole, first ensure you’re using the right DNS servers in the first place. Active Directory and DNS have a special relationship. Domain controllers register specific records in DNS servers they know about. These live in the _\_ldap.\_tcp.dc.msdcs._ zone and help AD-joined devices find resources such as domain controllers. SRV records won’t exist in DNS servers that aren’t [AD-integrated](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-integrated-dns-zones). To resolve this issue, you need to be using either: * An AD-integrated DNS server * A DNS server that replicates records from an AD aware DNS server * A DNS server that has _forwarding_ set up to query either an AD-integrated DNS server or a DNS server with replicated records To check that the DNS server you are using is one of the above, run the following command in a PowerShell session on an existing domain joined computer: ```powershell PS C:\> Get-DnsClientServerAddress InterfaceAlias Interface Address ServerAddresses Index Family -------------- --------- ------- --------------- Ethernet 9 IPv4 {10.0.0.101} Ethernet 9 IPv6 {} Loopback Pseudo-Interface 1 1 IPv4 {} Loopback Pseudo-Interface 1 1 IPv6 {fec0:0:0:ffff::1, fec0:0:0:ffff::2, fec0:0:0:ffff::3} ``` The responses you get under the _ServerAddesses_ column are the DNS servers being used by that computer. If you don’t have another domain client to check, you will need to contact your network team for this information. You can either use PowerShell’s `Set-DnsClientServerAddress` cmdlet to change the computer’s DNS client settings or via the IPv4 Properties dialog box for the network card of the computer. This is reached by going to _Control Panel –> Network –> Internet –> Network Connections._ Once in the _Network Connections_ window, right-click on the network card, choose _Properties_, choose _Internet Protocol Version 4 (TCP/IPv4)_ and then click on _Properties._ ![IPv4 properties dialog](/wp-content/uploads/2019/08/dns-settings.png "image_tooltip") _IPv4 properties dialog_ If the network uses _Dynamic Host Configuration Protocol_ (DHCP), ensure the _Obtain an IP address automatically_ and _Obtain DNS server address automatically_ options are selected. If your network doesn’t use DHCP then update the _Preferred DNS server_ and _Alternative DNS server_ values to the correct ones you obtained earlier. ## Find the True Error If you’ve confirmed your computer has the correct DNS servers then it’s time to jump in a little further. When you attempt to join a computer to a domain, the error “_An Active Directory Domain Controller Could not be Contacted”_ comes up but it’s not the “true” error message. You need to dive a little deeper. You’ll notice in the error dialog a _Details >>_ button. Click that. This will return more granular information allowing you to troubleshoot this error better. ![Expanded details view of the error dialog](/wp-content/uploads/2019/08/active-directory-domain-controller-could-not-be-contacted-details.png "image_tooltip") Expanded details view of the error dialog You can select the contents of the text box to copy and paste into a text viewer, or you can find the same information in the _C:\\windows\\debug\\dcdiag.txt_ file on that machine. This file is created by the Windows when the error occurs. The error text contains some key pieces of information. I’ve marked numbered and bolded each of these in the example below: * The domain name the machine thinks you’ve asked it to join **(1)** * The error code **(2)** * The DNS query that was made **(3)** * The DNS server(s) the machine queried (if any) **(4)** > _Note: This information is intended for a network administrator. If you are not your network’s administrator, notify the administrator that you have received this information, which has been recorded in the file C:\\windows\\debug\\dcdiag.txt._ > > _The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain “carisbrookelabs.local”**(1)**:_ > > _The error was: “DNS name does not exist.” > (error code 0x0000232B RCODE\_NAME\_ERROR) **(2)**_ > > _The query was for the SRV record for \_ldap.\_tcp.dc.\_msdcs.carisbrookelabs.local **(3)**_ > > _Common causes of this error include the following:_ > > _The DNS SRV records required to locate an AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when an AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:_ > > _8.8.4.4 > 8.8.8.8 **(4)**_ > > _One or more of the following zones do not include delegation to its child zone: carisbrookelabs.local_ > > _local > . (the root zone)_ ## 0x0000267C DNS\_ERROR\_NO\_DNS\_SERVER This error indicates that the DNS server could not be found to even attempt the query. It didn’t even get a chance. This is typically due to no network connectivity to the DNS server. > _Note that you can join a computer without a network connection known as an  [offline domain join](https://blogs.technet.microsoft.com/activedirectoryua/2009/05/27/new-djoin-exe-utility-in-windows-server-2008-r2/), but that is outside of the scope of this article._ ### Troubleshoot Your Network Connection If you see this error message, you’ll need to start doing some network troubleshooting. 1. Check that your network adapter is enabled and you can connect to other network resources. 2. Check that you have an IP address and DNS servers configured. You can check for an IP address and DNS servers by running `[ipconfig](https://adamtheautomator.com/ipconfig-commands/ "ipconfig") /all`. If you have an IP address and can reach other network resources, you’ll need to test your connection between the computer and the DNS server. To do so, you can use `ping` and PowerShell’s [`Test-Connection`](https://adamtheautomator.com/powershell-test-connection/) cmdlet. Test connectivity to the DNS server(s) using either of these two utilities. If _Internet Control Message Protocol_ (ICMP) traffic is allowed on the network, you should get a response. If there’s an error or time-out, you most likely have some sort of networking issue, such as routing. Talk to your networking team to resolve the issue, then try the join again. ### Check DNS connectivity If you’ve confirmed your network connection is working, you’ll next need to ensure your computer can connect via TCP/53 to the DNS server. Try using the [`Resolve-DNSName`](https://adamtheautomator.com/resolve-dnsname/ "Resolve-DNSName") PowerShell cmdlet with the FQDN of the domain you are trying to join. This should return one or more DNS server records: ```powershell PS C:\> Resolve-DNSName carisbrookelabs.local Name Type TTL Section IPAddress ---- ---- --- ------- --------- carisbrookelabs.local A 600 Answer 10.0.0.103 carisbrookelabs.local A 600 Answer 10.0.0.102 carisbrookelabs.local A 600 Answer 10.0.0.101 ``` If you get an error, then it is worth checking that there’s nothing blocking IP traffic on port 53 (the port used for DNS traffic) between your machine and the DNS servers. You can do a simple check for connectivity on port 53 using the [`Test-NetConnection`](https://adamtheautomator.com/test-netconnection/) cmdlet (not to be confused with the `Test-Connection` cmdlet): ```powershell PS C:\> Test-NetConnection -Port 53 -ComputerName True ``` You will get a response of _True_ if the connection succeeds, or _False_ if it fails. A failure could be due to a network or host-based firewall on the DNS server. ## 0x0000232B RCODE\_NAME\_ERROR This error means it was able to find the DNS server but the SRV record wasn’t found. This error requires a little more troubleshooting. ### Ensure You’re Using the Domain FQDN It seems simple, but verify that the name you typed matches the fully qualified domain name (FQDN) of the domain you are trying to join. This should only be a domain name, not a server name. For example, use carisbrookelabs.local and not WIN-3467RQTHJH5.carisbrookelabs.local. If there’s any doubt, check the domain name of an existing domain client. You can find the appropriate domain name by running this PowerShell command on an existing domain client. ```powershell PS51> (Get-CimInstance Win32_ComputerSystem).Domain carisbrookelabs.local ``` If you attempt to use the NETBIOS name (contoso) vs. the FQDN (contoso.local), the computer _might_ find the domain but Windows will treat the name as an FQDN anyway. If you type a NETBIOS name and don’t have a [WINS](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831671\(v=ws.11\)) infrastructure in place you _will_ get the error we’re trying to fix. Always use a FQDN rather than a [NETBIOS](https://en.wikipedia.org/wiki/NetBIOS_over_TCP/IP) name. ![Typing an FQDN in the Computer/Domain Changes dialog](/wp-content/uploads/2019/08/add-to-domain.png "image_tooltip") Typing an FQDN in the Computer/Domain Changes dialog ### Check DNS records For this step you are going to use `Resolve-DNSName` again. This time using the _exact_ [DNS record](https://adamtheautomator.com/powershell-dns/) that was not retrieved when you tried to join your machine to the domain. Copy and paste it from the _dcdiag.txt_ file mentioned in the introduction, or the copy of the error text you took earlier. This will avoid any typos with underscores and dashes. Your command should look something like this: ```powershell PS C:\> Resolve-DNSName _ldap._tcp.dc._msdcs.carisbrookelabs.local Name Type TTL Section PrimaryServer NameAdministrator SerialNumber ---- ---- --- ------- ------------- ----------------- ------------ _msdcs.carisbrookelabs.loca SOA 3600 Authority WIN-3467RQTHJH5.carisbrooke hostmaster.carisbrookelabs. 419 l labs.local local ``` > _Use the free Specops Password Auditor tool to scan your Active Directory and identify password-related vulnerabilities, including over 930 million known compromised passwords. [Download Today!](https://specopssoft.com/product/specops-password-auditor/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention)_ If you get _DNS name does not exist_ as the response to this command, then your issue is with DNS. * Ensure you’re using the correct DNS server * Ensure the relevant records have not been deleted If you get a positive response to `Resolve-DNSName _msdcs.` but get a _DNS name does not exist_ from `Resolve-DNSName _ldap._tcp.dc._msdcs.`, then the records are missing. Re-register your domain controller’s DNS records using the command `ipconfig /registerdns` on each DC. It may take a few minutes for the records to appear. Once you can confirm the presence of the required DNS record(s) using `Resolve-DNSName` then you should be good to go. ## Summary In this article, you’ve learned some steps to try when troubleshooting the error “_An Active Directory Domain Controller Could not be Contacted”_. It’s impossible to cover every single scenario in an article like this, but I hope the process works for you and gets you on the right path! ## Further Reading * **_[DNS and AD DS on Microsoft Docs](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/dns-and-ad-ds)_** * **_[Test-Connection: Ping Remote Hosts the PowerShell Way](https://adamtheautomator.com/powershell-test-connection/)_** * **_[Resolve-DNSName cmdlet on Microsoft Docs](https://docs.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname?view=win10-ps)_** * **_[Using The PowerShell Test-NetConnection Cmdlet on Windows](https://adamtheautomator.com/test-netconnection/)_** Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fan-active-directory-domain-controller-could-not-be-contacted%2F&text=Fix%20'An%20Active%20Directory%20Domain%20Controller%20Could%20Not%20Be%20Contacted')[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fan-active-directory-domain-controller-could-not-be-contacted%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fan-active-directory-domain-controller-could-not-be-contacted%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)