Timeout on loggin in to a Windows Domain

Question

Here's a really weird problem. I have a small company that is still running Windows SBS 2011 with about 19 computer connected to a domain. They are probably going to retire the server but Covid has changed plans for now.

One of the workstations (Windows 10 Pro) was intermittently having problems connecting to the domain controller. After a good deal of troubleshooting (more on this below) what I found was this. When starting or restarting the workstation, if I logged in immediately to Windows, everything was fine. If I restarted and left it on the Lock screen (or windows login screen) for a few minutes, it failed to connect to the domain and the network shares did not work. It does start up but if I try to access the network shares I get: "P:\ is not accessible. The system cannot contact a domain controller to service the authentication request. Please try again later" (also when I try accessing files from the UNC address). If I restart and immediately log in, its fine. I can log out and leave it for an extended period of time and its fine. Only when I shut down & start or restart and leave it on the login screen for a few minutes, do I have this problem. There is no hardware firewall that restricts LAN traffic, only a Google Wi-Fi that has NAT-translation firewall from outside the LAN.

Some of the things I have done that haven't helped are:

• Reset the Network
• Reset the firewall to default
• Turn off the firewall (Windows Defender) entirely
• SFC.exe /scannow
• Run the following command: dism /online /cleanup-image /restorehealth
• Removed the computer from the domain and rejoined
• ran an in-place Windows reinstall (a windows upgrade, not a "reset this PC") I will do a full reset only if I have to, as it takes me almost 6 hours to reinstall all software packages we use.
• switched from the ethernet adapter to the Wifi adapter
• Tried using different user accounts on this workstation (including the domain administrator account)

Answer 1

Hi

• If you bypass the Google Wi-Fi that NAT, does it work better ?
• If you change the location of the computer, does it work better ? (to know if it's a RJ45 cabling issue)
  • Can I ask what antivirus software you use ? I ask as some implement a network stack to filter the network connection.

I ask all those question as usually the error "The system cannot contact a domain controller to service the authentication request. Please try again later" is related to a bad DNS server setting on the NIC.

If the NIC can't talk to the DNS server correctly the NIC would broadcast a whois domainname and wait for the DC to answer.

If all the settings are corrects and you can ping the DNS server, make sure in your DNS's zone into your DC that you have not a old DC as nameserver still there. In the console you can easily seen if it's the case as it would be shown there; DNS's console->Direct search zone-> domainname->(same as parent) Nameserver, as if you see an old server there, let me know.

Thanks

Philippe

Answer 2

HI

1.Does this issue PC connect to SBS2011 by using VPN now?

2.Could you please enter below command on issue PC then check if this PC is using IPV6 address(not ipv4 address)?

The System Cannot Contact A Domain Controller To Service The Authentication Request
https://www.kapilarya.com/the-system-cannot-contact-a-domain-controller-to-service-the-authentication-request

Please Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice.

Answer 3

1. I'm not using a vpn to connect to the server.
2. I read the article and pinged the server (there wasn't a specific command but I assumed just pinging the server). It returned an IPv4 address. I tried setting the registry entry to prefer ipv4 over ipv6, anyway, as described in the article and it did not make any difference. Still failed to connect to the domain if I waited longer than about 2 minutes on the login screen. If I logged in right away - no problem.

Thanks for your help. This one is really weird!

Thinking that maybe it was some other software/service, I disabled all non-microsoft services and all startup programs. The problem still remained.

Michael

Answer 4

HI
"if I waited longer than about 2 minutes on the login screen. If I logged in right away - no problem."

1.If we diable wired network /wifi network, will there be the same above issue?

2.What's the difference between this issue win10 and normal win10?
Could you please enter below command on both this issue win10 and normal win10 respectively then look which the difference between them?
get-hotfix
Could you please enter below command on both this issue win10 and normal win10 respectively then look which the difference between them?
gpresult /h c:\win10normal.html
gpresult /h c:\win10issue.html

3.Did you check the system time is synchronized with AD domain?

4.Are there any logs in system, application, security in event viewer?

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

I'd check the domain controller and problem member both have the static ip address of DC listed for DNS and no others such as router or public DNS.

--please don't forget to upvote and Accept as answer if the reply is helpful--