Windows Event ID 5719 – NETLOGON: No Domain Controller Available

Start by verifying DNS configuration and testing domain controller discovery, as DNS issues cause the majority of Event ID 5719 occurrences.

1. Open Command Prompt as administrator and test DNS resolution for domain controllers:

   nslookup -type=SRV _ldap._tcp.dc._msdcs.yourdomain.com
   nslookup -type=A dc1.yourdomain.com

2. Verify the computer can resolve domain controller names and SRV records. If DNS fails, check DNS server configuration:

   Get-DnsClientServerAddress -AddressFamily IPv4
   Get-DnsClientCache | Where-Object {$_.Name -like "*yourdomain*"}

3. Test network connectivity to domain controllers on required ports:

   Test-NetConnection -ComputerName dc1.yourdomain.com -Port 389
   Test-NetConnection -ComputerName dc1.yourdomain.com -Port 88
   Test-NetConnection -ComputerName dc1.yourdomain.com -Port 445

4. If DNS resolution fails, configure correct DNS servers pointing to domain controllers or DNS servers hosting Active Directory zones.
5. Flush DNS cache and restart the NETLOGON service:

   ipconfig /flushdns
   net stop netlogon
   net start netlogon

Investigate network connectivity issues and firewall configurations that may block Active Directory communication.

1. Test comprehensive network connectivity to domain controllers using PowerShell:

   $DCs = @('dc1.yourdomain.com', 'dc2.yourdomain.com')
   $Ports = @(53, 88, 135, 389, 445, 464, 636, 3268, 3269)
   foreach ($DC in $DCs) {
       foreach ($Port in $Ports) {
           $Result = Test-NetConnection -ComputerName $DC -Port $Port -WarningAction SilentlyContinue
           Write-Output "$DC`:$Port - $($Result.TcpTestSucceeded)"
       }
   }

2. Check Windows Firewall rules that might block Active Directory traffic:

   Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Active Directory*" -or $_.DisplayName -like "*Kerberos*"} | Select-Object DisplayName, Enabled, Direction

3. Verify network adapter configuration and disable any VPN connections that might interfere:

   Get-NetAdapter | Where-Object {$_.Status -eq "Up"}
   Get-VpnConnection

4. Check routing table for conflicting routes:

   route print

5. If using Windows Firewall, temporarily disable it for testing (re-enable after testing):

   Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Time synchronization issues frequently cause Event ID 5719 as Kerberos authentication requires synchronized clocks within 5 minutes by default.

1. Check current time synchronization status and compare with domain controllers:

   w32tm /query /status
   w32tm /query /peers

2. Test time difference with domain controllers:

   $DCs = @('dc1.yourdomain.com', 'dc2.yourdomain.com')
   foreach ($DC in $DCs) {
       $DCTime = (Get-Date ([System.Net.NetworkInformation.Ping]::new().Send($DC).RoundtripTime))
       $LocalTime = Get-Date
       $TimeDiff = ($DCTime - $LocalTime).TotalSeconds
       Write-Output "$DC time difference: $TimeDiff seconds"
   }

3. Force time synchronization with domain hierarchy:

   w32tm /resync /force

4. Check Kerberos ticket cache and clear if corrupted:

   klist
   klist purge

5. Test Kerberos authentication to domain controllers:

   Test-ComputerSecureChannel -Server dc1.yourdomain.com -Verbose

6. If time sync fails, manually configure NTP servers in registry:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\W32Time\Parameters" -Name "NtpServer" -Value "dc1.yourdomain.com,0x1"

Computer account issues or secure channel corruption can cause persistent Event ID 5719 errors requiring account reset.

1. Test the current secure channel relationship:

   Test-ComputerSecureChannel -Verbose

2. Check computer account status in Event Viewer:Event Viewer → Windows Logs → System, filter for Event ID 5722, 5723, and 5805
3. Attempt to repair the secure channel:

   Test-ComputerSecureChannel -Repair -Verbose

4. If repair fails, reset the computer account password using PowerShell:

   Reset-ComputerMachinePassword -Server dc1.yourdomain.com -Credential (Get-Credential)

5. Alternative method using NETDOM command:

   netdom resetpwd /server:dc1.yourdomain.com /userd:domain\administrator /passwordd:*

6. Restart the computer after successful password reset to establish new secure channel
7. Verify the secure channel is working:

   Test-ComputerSecureChannel -Verbose
   nltest /sc_query:yourdomain.com

Enable detailed NETLOGON logging to capture comprehensive diagnostic information for complex Event ID 5719 scenarios.

1. Enable NETLOGON debug logging in the registry:

   New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "DBFlag" -Value 0x2080FFFF -PropertyType DWord -Force

2. Restart the NETLOGON service to activate logging:

   net stop netlogon
   net start netlogon

3. Monitor the NETLOGON debug log file:

   Get-Content C:\Windows\debug\netlogon.log -Tail 50 -Wait

4. Reproduce the issue and analyze log entries for domain controller discovery failures, authentication errors, or DNS resolution problems
5. Use NLTEST to perform comprehensive domain controller diagnostics:

   nltest /dsgetdc:yourdomain.com /force
   nltest /dclist:yourdomain.com
   nltest /trusted_domains

6. Check site configuration and domain controller location:

   nltest /dsgetsite
   nltest /dnsgetdc:yourdomain.com

7. After troubleshooting, disable debug logging to prevent log file growth:

   Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "DBFlag"

8. Restart NETLOGON service to apply changes:

   net stop netlogon
   net start netlogon