Azure domain controller lost connection with local domain controller

Question

Azure domain controller lost connection with local domain controller

James Ogar Admin 0

Our Azure Domain controller lost connection with only 1 sites domain controller, 3 other site connect fine

Manish Deshpande 6,505 Reputation points Microsoft External Staff Moderator

2026-05-14T19:55:37.6233333+00:00
Hi @James Ogar Admin ,

Thanks for sharing the details. Since the Azure domain controller is only unable to connect with one specific site DC while others are working fine, this typically points to a site-specific connectivity or replication issue, rather than a broader AD problem.

Based on Microsoft guidance, I recommend focusing on the below checks:

Verify network connectivity (most common cause)

Ensure both DCs can communicate with each other:

Test connectivity using:

ping <DCName>

nslookup <FQDN>

If connectivity fails only for that site, check:

VPN / ExpressRoute

NSG rules and firewall rules

Routing between Azure and that site

As per Microsoft, replication depends on reliable network connectivity and correct configuration between domain controllers.

Validate DNS configuration

Active Directory heavily relies on DNS:

Make sure both DCs are pointing only to internal AD DNS servers

Validate name resolution:

nslookup <dc-fqdn>

nslookup _ldap._tcp.dc._msdcs.<domain>

DNS issues are one of the most common causes of replication failures.

Check required ports and firewall rules

AD replication requires multiple ports to be open between DCs.

Key ports include:

RPC: TCP 135 + dynamic ports

LDAP: 389

Kerberos: 88

DNS: 53

Incorrect firewall/NSG rules blocking any of these ports can cause connectivity to fail between specific sites.

Run AD health and replication checks

On both DCs, run:

dcdiag /v repadmin /replsummary repadmin /showrepl

These will help identify:

Replication failures

DNS or authentication issues
Microsoft recommends using tools like Repadmin and DCDiag to isolate replication problems.

Validate AD Sites and Services configuration

Confirm both DCs are placed in the correct sites/subnets

Verify that replication connections exist between the sites

Check site link configuration and costs

Incorrect site topology can cause only certain DCs to become unreachable.

Review Event Logs

Check Directory Service, System, and DNS logs for:

RPC errors (e.g., 1722)

DNS resolution failures

Authentication/Kerberos errors

Event logs usually indicate the exact reason replication is failing.

Thanks,
Manish.
Manish Deshpande 6,505 Reputation points Microsoft External Staff Moderator

2026-05-26T02:17:22.2833333+00:00

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

1 answer

Your answer

Manish Deshpande 6,505 Reputation points Microsoft External Staff Moderator

2026-05-26T02:17:22.2833333+00:00

I wanted to check if my last response made sense. I’d be glad to assist further or explain anything in more detail and please accept as Yes and upvote if the answer is helpful so that it can help others in the community.

Answer 1

AI answer

Use standard domain controller connectivity and DC locator troubleshooting on both the Azure DC and the affected site DC.

Verify basic network connectivity
1. From the Azure DC, run ipconfig /all and confirm:
  - Correct IP, subnet, default gateway.
  - DNS servers point only to internal AD DNS servers, not public DNS.
2. From the Azure DC, ping the affected site DC by:
  - IP address.
  - Hostname.
  - FQDN.
3. From the affected site DC, do the same tests back to the Azure DC.
4. If ping fails in either direction, check site-to-site VPN, NSGs, firewalls, and routing between Azure and that specific site.
Check ports and firewalls
1. Use PortQry (from a management machine or the Azure DC) against the affected site DC FQDN and query Domains and Trusts services, focusing on UDP/389 (LDAP) and UDP/53 (DNS).
2. Ensure all required AD ports (especially LDAP 389/636, Kerberos 88, DNS 53, RPC 135, and dynamic RPC range) are allowed between the Azure DC and that site DC.
3. If any port is blocked only for that site, fix firewall/NSG rules.
Validate DNS and DC locator
1. On the Azure DC, run:
```
      nslookup <SiteDC_FQDN>
      nslookup guid._msdcs.<forest_root_domain>
```
  Confirm both resolve to the correct IPs.
2. If nslookup fails for the site DC or GUID records, on the affected DC:
  - Run ipconfig /registerdns.
  - Restart the Netlogon service to re-register SRV records.
3. On the Azure DC, run:
```
      nltest /dsgetdc:<DomainName> /force /kdc
```
  Confirm the affected site DC appears as an available DC or at least that a DC is discoverable.
Run health checks on both DCs
1. On both the Azure DC and the affected site DC, run:
```
      dcdiag /v > dcdiag.txt
```
  Review for DNS, Netlogon, replication, or locator errors.
2. If the affected DC is suspected to have issues, enable Netlogon debug logging on it:
```
      nltest /dbflag:0x2000ffff
```
  Then review %windir%\Debug\Netlogon.log for locator and authentication errors.
Check replication and quarantine state
1. In Active Directory Sites and Services, verify:
  - The Azure DC and the affected site DC are in correct sites and subnets.
  - Replication connections exist between the site and the Azure DC (directly or via hub DCs).
2. If the affected DC is quarantined (not replicating with others):
  - On that DC, run:
```
        repadmin /options <ServerName> -DISABLE_INBOUND_REPL
        repadmin /options <ServerName> -DISABLE_OUTBOUND_REPL
```
  - If needed, create a new replication connection to another DC in the same site.
Use LDP/LDAP to verify connectivity
1. From a management machine or the Azure DC, use Ldp.exe to connect and bind to the affected site DC.
2. If LDAP bind fails, focus on network/firewall and DNS between Azure and that site.
If still unresolved
1. Capture traffic with a network monitor (for example, Wireshark) between the Azure DC and the affected site DC to see where packets are dropped.
2. Check system, Directory Service, DNS, and NETLOGON event logs on both DCs for errors related to DC locator, Kerberos, or replication.

These steps will isolate whether the issue is network/firewall, DNS/DC locator, or a health/replication problem specific to that site DC.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

Share via

Azure domain controller lost connection with local domain controller

1 answer

Your answer