Network location awareness not detecting domain network from offsite location

Oryisi Robert 56 Reputation points
2021-05-19T02:19:46.417+00:00

The issue occurred after we started migrating our offsite workstations to Win 10. After joining computers to domain, computers show unidentified network connection instead of domain network connection. Computer is located at offsite location and was migrating to Win 10. NLA is working normally when it was still Win 7 workstation.

Registry workaround was applied and computer was able to detect Domain network connection, but there are times when connection will be set to unidentified network. NLA service startup has been set to Automatic (Delayed Start).

Thanks in advance.

Windows 10 Network
Windows 10 Network
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Network: A group of devices that communicate either wirelessly or via a physical connection.
2,248 questions
{count} votes

Accepted answer
  1. Sunny Qi 10,941 Reputation points Microsoft Vendor
    2021-05-19T04:39:14.717+00:00

    Hi,

    Thanks for posting in Q&A platform.

    After machine reboots, before NIC adapter initializes, NLASVC would attempt detection of domain, if the detection was failed, then this information will be cached and even though NIC gets initialized, the machine still apply the cached information and hence machine detects unidentified network.

    Please try to modify the following registry keys to see if the issue can be resolved:

    First, disable Domain Discovery negative cache by adding the NegativeCachePeriod registry key to following subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters
    Name: NegativeCachePeriod
    Type: REG_DWORD
    Value Data: 0 (default value: 45 seconds; set to 0 to disable caching)

    If issue doesn’t resolve, furtherly disable DNS negative cache by adding the MaxNegativeCacheTtl registry key to the following subkey:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
    Name: MaxNegativeCacheTtl
    Type: REG_DWORD
    Value Data: 0 (default value: 5 seconds; set to 0 to disable caching)

    Note: This registry key disables the Domain detection negative cache. NLA normally detect Domain multiple times at network setup (triggered by route change, IP address change etc). But if the first time detection failed with negative result (such as ERROR_NO_SUCH_DOMAIN), this negative result gets cached in netlogon, and will be reused in next time NLA domain discovery.

    There is also another registry key we need add:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters

    Add a DWORD parameter :AlwaysExpectDomainController

    Set value to:1

    Note: This registry key alters the behavior when NLA retries domain detection.

    Best Regards,
    Sunny

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    15 people found this answer helpful.

4 additional answers

Sort by: Most helpful
  1. UnluckyJelly 21 Reputation points
    2021-07-29T21:29:16.19+00:00

    Question for Sunny,

    Is is possible to have more details on what the registry key : AlwaysExpectDomainController = 1 is changing in the Nlasvc behavoir ? I have not found any other reference to this key other than your reference to it.

    thanks.

    4 people found this answer helpful.

  2. Patrick LOUBET 6 Reputation points
    2021-12-14T09:07:53.577+00:00

    Omg ! The only exact answer, among a thousand posts, to a question driving me crazy until we switched to Global Protect VPN.
    Thanks a lot Sunny.
    Isn't there a way for you Microsoft guys to widely publish that info ? I am sure a lot of IT admins around the world are getting bald with this :-)
    Best regards

    1 person found this answer helpful.

  3. Dave Patrick 426.1K Reputation points MVP
    2021-05-19T02:26:38.303+00:00

    Computer is located at offsite location

    How are you connecting to the domain? When NLA starts to detect the network location, the machine will contact a domain controller via port 389. If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile.
    If the domain was not found or process failed, NLA will let you to determine which firewall profile will be used, private or public.

    --please don't forget to Accept as answer if the reply is helpful--


  4. Roudnev, Alexei P 1st Lt 0 Reputation points
    2023-10-13T02:11:14.7166667+00:00

    MY question is how LNA got the list of DC, and why it tries only one of dozen's DC? And it do it exactly on all systems. Moreover, it decided that system is on PUBLIC network even when it runs on DC itself.