question

OryisiRobert-3472 avatar image
1 Vote"
OryisiRobert-3472 asked Shane-6631 commented

Network location awareness not detecting domain network from offsite location

The issue occurred after we started migrating our offsite workstations to Win 10. After joining computers to domain, computers show unidentified network connection instead of domain network connection. Computer is located at offsite location and was migrating to Win 10. NLA is working normally when it was still Win 7 workstation.

Registry workaround was applied and computer was able to detect Domain network connection, but there are times when connection will be set to unidentified network. NLA service startup has been set to Automatic (Delayed Start).

Thanks in advance.

windows-10-network
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SunnyQi-MSFT avatar image
1 Vote"
SunnyQi-MSFT answered Shane-6631 commented

Hi,

Thanks for posting in Q&A platform.

After machine reboots, before NIC adapter initializes, NLASVC would attempt detection of domain, if the detection was failed, then this information will be cached and even though NIC gets initialized, the machine still apply the cached information and hence machine detects unidentified network.

Please try to modify the following registry keys to see if the issue can be resolved:

First, disable Domain Discovery negative cache by adding the NegativeCachePeriod registry key to following subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters
Name: N*egativeCachePeriod
Type:
REG_DWORD
Value Data:
0* (default value: 45 seconds; set to 0 to disable caching)

If issue doesn’t resolve, furtherly disable DNS negative cache by adding the MaxNegativeCacheTtl registry key to the following subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
Name: MaxNegativeCacheTtl
Type: REG_DWORD
Value Data: 0 (default value: 5 seconds; set to 0 to disable caching)

Note: This registry key disables the Domain detection negative cache. NLA normally detect Domain multiple times at network setup (triggered by route change, IP address change etc). But if the first time detection failed with negative result (such as ERROR_NO_SUCH_DOMAIN), this negative result gets cached in netlogon, and will be reused in next time NLA domain discovery.

There is also another registry key we need add:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters

Add a DWORD parameter :AlwaysExpectDomainController

Set value to:1

Note: This registry key alters the behavior when NLA retries domain detection.

Best Regards,
Sunny


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks for your response Sunny. Actually we have applied the first two options before I posted this question. It worked for a while, and then the connection was detected to unidentified network again. I have tried to add the 3rd registry key as you recommended, it works now. I will keep monitoring and keep you posted. Thank you for your support.

1 Vote 1 ·
jtraubitz avatar image jtraubitz OryisiRobert-3472 ·

Is this still working for you? I'm having the same issue.

EDIT: I've rolled out all three registry keys above to a small subset of my users with success so far. None of them have experienced the issue again. And most importantly none of them seem to have any new issues despite the complete lack of documentation on AlwaysExpectDomainController.

0 Votes 0 ·

Thank you so much for this solution! I have been trying to resolve this frustrating issue on multiple computers in multiple domains, and it's especially difficult with remote users using a VPN connection to the domain. I have talked to many experts who say this is an issue with Windows Firewall and that specifying a DNS suffix will work, but this solution (I just added all 3 registry keys the first try) finally worked.

For anyone else looking at this problem, this should be especially helpful for VPN users and remote workers because this directly addresses the issue of no domain connection at logon.

0 Votes 0 ·
DSPatrick avatar image
0 Votes"
DSPatrick answered

Computer is located at offsite location

How are you connecting to the domain? When NLA starts to detect the network location, the machine will contact a domain controller via port 389. If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile.
If the domain was not found or process failed, NLA will let you to determine which firewall profile will be used, private or public.

--please don't forget to Accept as answer if the reply is helpful--









5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NamCt-4642 avatar image
1 Vote"
NamCt-4642 answered jtraubitz edited

Question for Sunny,

Is is possible to have more details on what the registry key : AlwaysExpectDomainController = 1 is changing in the Nlasvc behavoir ? I have not found any other reference to this key other than your reference to it.

thanks.



· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hey I had the exact same question. Here's what I got from another rep in a support request:

AlwaysExpectDomainController is for the device to send continuously the SRV query requesting the LDAP to the domain controller until it gets an answer.

0 Votes 0 ·