Active Directory Domain Services Unavailable: Fixes

Updated 4 November 2026 · Standard formula, shown below

If you see “Active Directory Domain Services is currently unavailable,” it usually means a domain-joined computer cannot reach a domain controller or the Kerberos authentication service. This guide explains the common causes and provides step-by-step fixes you can try, from checking network connectivity to verifying DNS and time synchronization.

What Is Active Directory Domain Services?

Active Directory Domain Services (AD DS) is a directory service developed by Microsoft for Windows domain networks. It stores information about users, computers, groups, and other objects, and it authenticates logon attempts using Kerberos. When a computer is joined to a domain, it relies on AD DS to validate credentials, apply Group Policy, and locate resources. The error “Active Directory Domain Services is currently unavailable” typically appears when a client cannot contact a domain controller or when authentication fails.

Common Causes of the Error

Network connectivity issues: The client cannot reach the domain controller due to a disconnected cable, Wi-Fi problems, or a firewall blocking ports (especially 53 for DNS, 88 for Kerberos, 389 for LDAP).
DNS misconfiguration: The client’s DNS server is not set to the domain controller’s IP, or the DNS records for the domain controller are missing or stale.
Time skew: Kerberos requires the client and server clocks to be within 5 minutes of each other. Large time differences cause authentication failures.
Domain controller down or unreachable: The domain controller itself may be offline, rebooting, or experiencing hardware issues.
Stale cached credentials: The computer’s cached logon information may be corrupted or outdated.
Group Policy or permission problems: The user account may have been locked out, disabled, or removed from the domain.

How to Fix the Error: Step-by-Step

Check network connectivity: Open Command Prompt and run ping <domain controller IP>. If ping fails, verify the network cable, Wi-Fi connection, and that the domain controller is powered on.
Verify DNS settings: Run ipconfig /all and ensure the DNS server is set to the domain controller’s IP address (not a public DNS like 8.8.8.8). Then run nslookup <domain name> to confirm the domain controller’s IP is returned.
Check time synchronization: Run w32tm /query /status to see the current time source. If the time is off by more than 5 minutes, run w32tm /resync or manually set the time in Control Panel.
Test authentication with a different account: Try logging in with a local account (e.g., .\Administrator) to see if the issue is with the domain account.
Clear cached credentials: In Credential Manager (Control Panel > User Accounts > Credential Manager), remove any saved domain credentials, then restart.
Restart the Netlogon service: Run net stop netlogon && net start netlogon as an administrator.
Rejoin the domain: If all else fails, unjoin the computer from the domain (System Properties > Computer Name > Change), restart, then rejoin using a domain admin account.

When the Error Occurs on a Domain Controller

If the error appears on a domain controller itself, the problem may be with the AD DS service or the directory database. Check the Services console (services.msc) to ensure the “Active Directory Domain Services” service is running. If it is not, try starting it manually. If it fails, use Directory Services Restore Mode (DSRM) to repair the database using ntdsutil. This scenario is more complex and often requires a backup or authoritative restore.

Preventive Measures

Configure redundant domain controllers and DNS servers to avoid a single point of failure.
Monitor domain controller health with tools like dcdiag and repadmin.
Keep all systems updated with Windows patches.
Use a Network Time Protocol (NTP) source for all domain members.
Document your DNS records and regularly audit them.

Frequently Asked Questions

Why does the error appear even when I can ping the domain controller?

Ping only confirms basic network connectivity. The error can still occur if DNS resolution fails, if Kerberos ports are blocked, or if the time is skewed. Use nltest /dsgetdc:<domain> to test domain controller discovery, and check event logs for specific error codes.

Can I fix this without a domain administrator?

Some fixes, like checking network cables or adjusting time, can be done by a regular user. However, most steps (restarting services, changing DNS, rejoining the domain) require local administrator privileges. If you don’t have them, contact your IT support.

Will I lose my files if I rejoin the domain?

Rejoining the domain does not delete local files, but it may reset the computer’s security identifier (SID) and cause the user profile to be treated as a new profile. Back up important data before attempting this step.

How do I check if my DNS is correct?

Run ipconfig /all and look at the DNS Servers section. It should list the IP of your domain controller or a DNS server that can resolve your domain. Then run nslookup yourdomain.com to see if it returns the domain controller’s IP.

What is the most common cause of this error?

In many cases, the root cause is misconfigured DNS on the client machine. If the client is using an external DNS server, it cannot find the domain controller. Always ensure the client’s DNS points to a server that hosts the AD DS zone.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.