Skip to content

Commit 995ebab

Browse files
Deland-HanDeland-Han
committed
update
1 parent f07e2ca commit 995ebab

3 files changed

Lines changed: 167 additions & 45 deletions

File tree

‎support/windows-server/active-directory/active-directory-domain-join-troubleshooting-guidance.md‎

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -129,50 +129,7 @@ The output indicates that the Kerberos Port TCP 88 is open between the client an
129129

130130
### Error code 0x54b
131131

132-
:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/error-0x54b-message.png" alt-text="Screenshot of the dialog box showing the error message for error code 0x54b.":::
133-
134-
Here's an example of the error message:
135-
136-
> Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\WINDOWS\debug\dcdiag.txt.
137-
>
138-
> The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "<domain_name>":
139-
>
140-
> The error was: "This operation returned because the timeout period expired."
141-
> (error code 0x000005B4 ERROR_TIMEOUT)
142-
>
143-
> The query was for the SRV record for <srv_record>
144-
>
145-
> The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:
146-
>
147-
> <ip_address>
148-
>
149-
> Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.
150-
151-
Here's an example from the *netsetup.log* file:
152-
153-
```output
154-
mm/dd/yyyy hh:mm:ss:ms NetpValidateName: checking to see if '<domain_name>' is valid as type 3 name
155-
mm/dd/yyyy hh:mm:ss:ms NetpCheckDomainNameIsValid for <domain_name> returned 0x54b, last error is 0x0
156-
mm/dd/yyyy hh:mm:ss:ms NetpCheckDomainNameIsValid [ Exists ] for '<domain_name>' returned 0x54b
157-
```
158-
159-
To resolve the 0x54b error, follow these steps:
160-
161-
- Check the network connectivity between the client and the Domain controller.
162-
- Verify if the Preferred DNS Server is the correct DNS Server.
163-
- Run `nltest /dsgetdc` (DC Discovery) to verify if you can discover a DC.
164-
165-
For example:
166-
167-
```console
168-
nltest /dsgetdc:<domain_name> /force
169-
```
170-
171-
Expected Output:
172-
173-
:::image type="content" source="media/active-directory-domain-join-troubleshooting-guidance/nltest-output.png" alt-text="Screenshot that shows the nltest command output.":::
174-
175-
- Run `DCDiag /v` on the closest domain controller and verify if SRV records are registered. For example: `_ldap._tcp.dc._msdcs.<domain_name>.com`.
132+
For more information, see [Domain join error code 0x54b](error-code-0x54b.md).
176133

177134
### Error code 0x0000232A
178135

‎support/windows-server/active-directory/error-code-0x54b.md‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: Domain join error code 0x54b
3+
description: Provides troubleshooting steps for resolving the error code 0x54b when you join a workgroup computer to a domain.
4+
ms.date: 04/17/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: eriw,dennhu,herbertm
9+
ms.custom:
10+
- sap:active directory\on-premises active directory domain join
11+
- pcy:WinComm Directory Services
12+
---
13+
# Domain join error code 0x54b
14+
15+
This article provides troubleshooting steps for resolving the error code 0x54b when you join a workgroup computer to a domain.
16+
17+
## Symptom
18+
19+
When you join a workgroup computer to a domain, you receive the following error message:
20+
21+
> **Error code 0x0000232A**
22+
>
23+
> Computer Name/Domain Changes
24+
>
25+
> An Active Directory Domain Controller (AD DC) for the domain "\<NetBIOS\\_name>" could not be contacted.
26+
>
27+
> Ensure that the domain name is typed correctly.
28+
>
29+
> If the name is correct, click Details for troubleshooting information.
30+
>
31+
> Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\WINDOWS\debug\dcdiag.txt.
32+
>
33+
> The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "\<domain\_name>":
34+
>
35+
> The error was: "This operation returned because the timeout period expired." (error code 0x000005B4 ERROR\_TIMEOUT)
36+
>
37+
> The query was for the SRV record for \<srv\_record>
38+
>
39+
> The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:
40+
> \<ip\_address>
41+
>
42+
> Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.
43+
44+
Here's an example from the *netsetup.log* file:
45+
46+
```output
47+
mm/dd/yyyy hh:mm:ss:ms NetpValidateName: checking to see if '<domain_name>' is valid as type 3 name
48+
mm/dd/yyyy hh:mm:ss:ms NetpCheckDomainNameIsValid for <domain_name> returned 0x54b, last error is 0x0
49+
mm/dd/yyyy hh:mm:ss:ms NetpCheckDomainNameIsValid [ Exists ] for '<domain_name>' returned 0x54b
50+
```
51+
52+
## Cause
53+
54+
Error code 0x54b means "ERROR\_NO\_SUCH\_DOMAIN". This error code indicates the specified domain couldn't be contacted, pointing to issues in locating domain controllers.
55+
56+
* Domain Name System (DNS) time-outs and resolution failures when attempting to reach domain controllers.
57+
* Network connectivity to DC is blocked on TCP port 135,389,445, or RPC dynamic ports.
58+
59+
## Troubleshooting steps
60+
61+
To resolve the 0x54b error, follow these steps:
62+
63+
### Step 1
64+
65+
Check the network connectivity between the client and the Domain controller
66+
67+
| Server Port | Service |
68+
| --------------- | ------------------- |
69+
| TCP 135 | RPC Endpoint Mapper |
70+
| TCP 49152-65535 | RPC Dynamic Ports |
71+
| TCP 445 | SMB |
72+
| UDP/TCP 389 | LDAP |
73+
74+
* Refer to the list of required ports in [How to configure a firewall for Active Directory domains and trusts](config-firewall-for-ad-domains-and-trusts.md) .
75+
76+
* Use Test-NetConnection command to test connection between DC.
77+
78+
```powershell
79+
Test-NetConnection <IP\_address\_of\_the\_DC> -Port 389
80+
81+
ComputerName: <computer_name>
82+
RemoteAddress: <remote_address>
83+
RemotePort: 389
84+
InterfaceAlias: Ethernet 2
85+
SourceAddress: <source_address>
86+
TcpTestSucceeded : True
87+
88+
It indicates that the LDAP Port TCP 389 is open between the client and the DC.
89+
90+
* [PortQry Command Line Port Scanner Version 2.0](https://www.microsoft.com/download/details.aspx?id=17148) can also be used to identify if a port(TCP/UDP) is blocked on DC. Example syntax:
91+
92+
```console
93+
portqry -n <problem_server> -e 135
94+
portqry -n <problem_server> -e 445
95+
portqry -n <problem_server> -e 389
96+
portqry -n <problem_server> -p UDP -e 389
97+
portqry -n <problem_server> -r 49152:65535
98+
```
99+
100+
Port query output examples:
101+
102+
* On connection to TCP Port 135 on DC is blocked, the following message is displayed:
103+
104+
```console
105+
portqry -n <dc_name> -e 135
106+
107+
Querying target system called:
108+
109+
<dc_name>
110+
111+
Attempting to resolve name to IP address...
112+
113+
Name resolved to <ip_address>
114+
115+
querying...
116+
117+
TCP port 135 (epmap service):FILTERED
118+
```
119+
120+
* On successful connection to TCP port 389 on DC, the following message is displayed:
121+
122+
```console
123+
portqry -n <dc_name> -e 389
124+
125+
Querying target system called:
126+
127+
<dc_name>
128+
129+
Attempting to resolve name to IP address...
130+
131+
Name resolved to 192.168.1.2
132+
133+
querying...
134+
135+
TCP port 389 (ldap service): LISTENING
136+
137+
* Collect network monitor trace when reproducing the issue to confirm if there's any network connectivity issue if necessary.
138+
139+
### Step 2
140+
141+
Verify if the Preferred DNS Server is the correct DNS Server.
142+
143+
### Step 3
144+
145+
Run `nltest /dsgetdc` (DC Discovery) to verify if you can discover a DC. For example:
146+
147+
```console
148+
nltest /dsgetdc:<domain_name> /force
149+
150+
DC: \\<dc_address>
151+
Address: \\<dc_address>
152+
Dom Guid: <dom_guid>
153+
Dom Name: <dom_name>
154+
Forest Name: <foreast_name>
155+
Dc Site name: Default-First-site-Name
156+
Our Site Name: Default-First-site-Name
157+
Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST
158+
The command completed successfully
159+
```
160+
161+
### Step 4
162+
163+
Run `DCDiag /v` on the closest domain controller and verify if SRV records are registered. For example: **\_ldap.\_tcp.dc.\_msdcs.\<domain\_name>.com.**

‎support/windows-server/toc.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -349,12 +349,14 @@ items:
349349
href: ./active-directory/cannot-connect-internet-domain.md
350350
- name: Default limit to workstation numbers
351351
href: ./active-directory/default-workstation-numbers-join-domain.md
352-
- name: 'Error 0x6D9 "No more endpoints available from the endpoint mapper"'
352+
- name: Error 0x6D9 "No more endpoints available from the endpoint mapper"
353353
href: ./active-directory/domain-join-error-0x6d9-there-are-no-more-endpoints-available-from-the-endpoint-mapper.md
354354
- name: Failure when you use an existing computer account to join a domain
355355
href: ./active-directory/failure-when-you-use-an-existing-computer-account-to-join-a-domain.md
356356
- name: Error 0x5 Access Denied when you rename a computer
357357
href: ./active-directory/error-0x5-access-denied-rename-computer.md
358+
- name: Error code 0x54b
359+
href: active-directory/error-code-0x54b.md
358360
- name: Error code 0x569
359361
href: ./active-directory/error-0x569-not-granted-logon-type.md
360362
- name: Error code 0xa8b

0 commit comments

Comments
 (0)