Netlogon 5719 and the Disappearing Domain [Controller]

Netlogon is a client and a server component; when it logs 5719 it is acting as a client and trying to make a network connection that fails for some reason.

A Netlogon 5719 event indicates that the client component of Netlogon was unable to locate a DC for the domain it was trying to perform an operation against.

Most of the time this is caused by network issues or name resolution (DNS/WINS) issues.  Network devices (Switches/Routers/Firewalls) on the way are also on the list of prime suspects behind Netlogon 5719 events. That includes the NIC drivers on both the client logging the event and DC's it is trying to reach.

If this is being logged on a DC and the event refers to the DC's own domain, something might be preventing the client component of Netlogon from starting a network session (to itself or to another DC in the domain). Since this is a client component error, port exhaustion can be one possible cause.

If this is referring to remote trusted or trusting domains then connectivity and name resolution for those domains need to be investigated further.

Less frequently, this is caused by a resource leak on the machine logging the event or the target DC(s) it is trying to talk to.

If you're only seeing Netlogon 5719 at startup then the port the machine is connected to on your switch may not be fully up when Netlogon starts.

Netlogon is otherwise a patient client component and will retry again 2 mins after the initial failure and every now and then after that until it is able to reach a DC.

On the other hand, Applications that are relying on Netlogon having domain connectivity when they start might fail as a result if they aren't handling sporadic network outages properly.

Netlogon can be configured to increase the time it waits for the DC to respond by using the ExpectedDialUpDelay registry key.

Further reading:

PRB: Netlogon Logs Event ID 5719 on a Domain Controller

Cannot connect to domain controller and cannot apply Group Policy with Gigabit Ethernet devices

IIS runs out of work items and causes RPC failures when connecting to a remote UNC path

How to force Kerberos to use TCP instead of UDP in Windows Server 2003, in Windows XP, and in Windows 2000

Error message in a Windows Server 2003-based domain or in a Windows 2000 Server-based domain: "The remote procedure call failed and did not run"

How to Troubleshoot Black Hole Router Issues

When you try to connect from TCP ports greater than 5000 you receive the error 'WSAENOBUFS (10055)'

Making Netlogon wait longer for a response from a DC before timing out

Using PortFast and Other Commands to Fix Workstation Startup Connectivity Delays (Netlogon 5719)