Windows Event ID 902 – DNS Client: DNS Query Timeout or Resolution Failure

Start by checking the current DNS configuration and testing connectivity to configured DNS servers.

1. Open Command Prompt as Administrator and check current DNS configuration:

   ipconfig /all

2. Test DNS server connectivity using ping:

   ping 8.8.8.8
   ping 1.1.1.1

3. Perform DNS resolution tests:

   nslookup google.com
   nslookup microsoft.com 8.8.8.8

4. Check DNS client service status:

   Get-Service -Name Dnscache | Select-Object Name, Status, StartType

5. View recent DNS-related events:

   Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='DNS Client'; Id=902} -MaxEvents 20

6. If DNS servers are unresponsive, temporarily switch to public DNS servers like 8.8.8.8 or 1.1.1.1 in network adapter settings.

Clear corrupted DNS cache entries and reset network configuration to resolve DNS resolution issues.

1. Flush the DNS resolver cache:

   ipconfig /flushdns

2. Clear NetBIOS name cache:

   nbtstat -R

3. Reset Winsock catalog:

   netsh winsock reset

4. Reset TCP/IP stack:

   netsh int ip reset

5. Restart DNS Client service:

   Restart-Service -Name Dnscache -Force

6. Register DNS records:

   ipconfig /registerdns

7. Restart the computer to complete network stack reset.
8. After restart, test DNS resolution:

   Test-NetConnection -ComputerName google.com -Port 80

Adjust DNS client timeout values and configuration through registry modifications to handle slow DNS responses.

1. Open Registry Editor and navigate to DNS client settings:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

2. Create or modify the following DWORD values to increase timeout periods:
   • MaxCacheTtl = 86400 (24 hours in seconds)
   • MaxNegativeCacheTtl = 300 (5 minutes)
   • NetFailureCacheTime = 30 (30 seconds)
3. Configure DNS query timeout using PowerShell:

   Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses "8.8.8.8","8.8.4.4"

4. Set DNS suffix search list:

   Set-DnsClientGlobalSetting -SuffixSearchList @("contoso.com","corp.local")

5. Restart DNS Client service to apply changes:

   Restart-Service -Name Dnscache

6. Monitor DNS performance using Performance Monitor counters under DNS Client object.

Perform comprehensive network diagnostics to identify infrastructure issues causing DNS timeouts.

1. Run network diagnostics and capture detailed information:

   Test-NetConnection -ComputerName 8.8.8.8 -Port 53 -InformationLevel Detailed

2. Trace network route to DNS servers:

   Test-NetConnection -ComputerName 8.8.8.8 -TraceRoute

3. Check for packet loss and latency:

   ping -t -l 1472 8.8.8.8

4. Analyze DNS server response times:

   Measure-Command { Resolve-DnsName google.com }

5. Check Windows Firewall DNS rules:

   Get-NetFirewallRule -DisplayName "*DNS*" | Select-Object DisplayName, Enabled, Direction

6. Review network adapter configuration:

   Get-NetAdapter | Get-NetIPConfiguration

7. If using Active Directory, verify DNS zone health:

   Get-DnsServerZone -ComputerName DC01

8. Check DNS server event logs on domain controllers for corresponding errors.

Use advanced diagnostic tools to capture and analyze DNS traffic for detailed troubleshooting.

1. Enable DNS Client logging for detailed diagnostics:

   wevtutil sl Microsoft-Windows-DNS-Client/Operational /e:true

2. Start network packet capture focusing on DNS traffic:

   netsh trace start capture=yes provider=Microsoft-Windows-TCPIP tracefile=dns_trace.etl

3. Reproduce the DNS timeout issue while capture is running.
4. Stop the network trace:

   netsh trace stop

5. Analyze DNS queries using PowerShell:

   Get-WinEvent -Path "C:\Windows\System32\LogFiles\WMI\dns_trace.etl" | Where-Object {$_.Id -eq 902}

6. Use DNS debugging tools to test specific queries:

   Resolve-DnsName -Name problematic-domain.com -Server 8.8.8.8 -Type A -DnsOnly

7. Check DNS Client operational log for detailed query information:

   Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" -MaxEvents 50

8. Review captured network traffic using Network Monitor or Wireshark to identify specific DNS query failures and response patterns.