Lỗi only active account can create or edit ads
When I try to join a new Windows workstation or server to an Active Directory (AD) domain, I sometimes encounter the following error: “An Active Directory Domain Controller (AD DC) for the domain ‘domainname’ could not be contacted.” Show
This error can occur due to any of several reasons, from a simple incorrect DNS server IP address to a much more complex issue. In this blog, I will walk you through the steps you need to troubleshoot this problem, from the simplest to the most complex. When the Error ArisesThe error can be displayed when you attempt to join a workstation or server to a domain. Here are the steps that lead up to the error:
Initial Troubleshooting StepsFirst, ensure that you typed the domain name correctly. If that’s not the problem, click Details to get information about the error. The following sections detail the steps to take to get to the root of the problem. In most cases, the issue is related to one of the following: incorrect DNS settings or a wrong IP address on your system, DNS misconfiguration on the domain controller (DC) side, or ports that are blocked on the firewall. If you do not know the root of the problem, I suggest proceeding through these troubleshooting options in order. However, if you have additional information, feel free to proceed directly to the step that you think is likely to solve the problem. Verify that the IP Settings are CorrectMake sure that the network interface of your computer has the right IP address. The IP address can be explicitly defined in the network adapter settings or can be obtained from a DHCP server. To get the computer’s current network settings, use this command: Make sure the DNS Client Service is RunningNext, check whether the DNS client service is up and running using this command: Check the Host File for Domain EntriesMake sure there are no entries for your domain or domain controller names in the hosts file located at C:\Windows\System32\Drivers\etc\hosts on the PC. Open the file with Notepad or any other text editor. If there are any entries for your domain or DC names, delete them. To view the contents of the hosts file on the PC, use this command: Restart the DNS Cache ServiceOpen an elevated command prompt and clear the DNS cache using this command:
Then stop and restart the dnscache service using this command: Alternatively, you can use the Service.msc console. Right-click on DNS Client to open its properties dialog: Click use the Stop and Start buttons to stop and restart the service: Check whether the DC is Reachable from the ClientTo determine whether the domain controller is reachable from the client, first run the following commands from a command prompt: Then run this command: You should also check the availability of the DC from another workstation on the same network. If your client cannot access the DC but other clients can, there could be a problem with your client’s cable or hardware, or with a device in the middle. To narrow down the problem, try a different network jack or go wireless. Check the DC’s Accessibility using PowerShellAlternatively, you can use the following PowerShell cmdlets to check the connectivity to the DC. To display the IP address: To ping the DC: To trace the routes to the DC: Add the DNS server to the TCP/IP settings of your Network AdapterIf the domain controller can be reached, try adding the IP address of your DNS server to your network adapter’s Advanced TCP/IP settings.
Check whether you’re using the Right DNS serversBefore you go too deep down the rabbit hole, double-check that you are using the correct DNS servers. Specifically, the DNS servers that DCs are aware of are used to register records that help AD-connected devices locate resources like DCs; DNS servers that are not AD-integrated do not have these records. According, make sure you are using one of the following:
To check that your DNS server is one of these, use the PowerShell cmdlet shown below in a PowerShell session on a domain-joined PC. (If you don’t have another domain client to use, you will need to contact your network staff.)
0 The DNS servers used by the computer running the cmdlet are listed in the ServerAddesses column. Option 1: Update the Computer’s DNS Client SettingsIf you need to update the computer’s DNS client settings, you can use the following cmdlet:
1 Alternatively, you can use the IPv4 Properties dialog box for the computer’s network card: Go to Control Panel –> Network –> Internet –> Network Connections. Then right-click on the network card, select Properties and then Internet Protocol Version 4 (TCP/IPv4), and then Properties. Review the settings: ![Option 1: Update the Computer’s DNS Client Settings ](https://blog.netwrix.com/wp-content/uploads/2023/05/Picture21.webp) If the network supports Dynamic Host Configuration Protocol (DHCP), ensure that both the Obtain an IP address automatically and Obtain DNS server address automatically boxes are checked. If your network does not use DHCP, change the values for Preferred DNS server and Alternative DNS server to the ones you found previously (when you ran the Set-DnsClientServerAddress cmdlet). Option 2: Connect to the Domain through Windows SettingsAnother option is to connect to the domain through Windows Settings:
Check whether a Firewall is blocking port 53 on the DCCheck whether the DNS service on the DC is being blocked by a firewall. To see whether port 53 is available on the DC, use this cmdlet:
2 Check the value of “TcpTestSucceeded”. A value of “True” as shown below indicates that the DNS service on the DC is operational. Check whether your Computer can resolve the Domain Name of the DCNext, check whether the workstation can accurately resolve the domain name to the DC’s IP address. Use the fully qualified domain name of the domain to which you are trying to join your workstation with the Resolve-DNSName cmdlet, as shown here:
3 This command should return one or more DNS server records. Check whether the Workstation can Contact the DNS server that hosts the DNS zoneNext, check whether:
To get the domain and DC information, along with the IP address, use the following cmdlet:
4 If the command completes successfully, it will return information like the following:
5 Restart the Netlogon Service on the Domain ControllerRestart the Netlogon service on the DC using this command:
6 Alternatively, simply reboot the DC. When the server restarts, it will try to register the necessary SRV records on the DNS server. Re-register the DC’s DNS recordsRe-register the DC’s DNS records by running this command:
7 Wait for the records to arrive in DNS and for them to propagate across the domain. Since 2012, Jonathan Blackwell, an engineer and innovator, has provided engineering leadership that has put Netwrix GroupID at the forefront of group and user management for Active Directory and Azure AD environments. His experience in development, marketing, and sales allows Jonathan to fully understand the Identity market and how buyers think. |