Switch Domain Controller: How to Change DCs

Updated 15 November 2026 · Standard formula, shown below

Switching domain controllers means changing which domain controller (DC) your computer or service authenticates against and gets directory data from. You can do this manually by changing DNS settings, or automatically by letting the domain controller locator process pick the best available DC. This article explains the methods, when each is appropriate, and the common pitfalls to avoid.

Why You Might Need to Switch

You usually switch DCs for one of these reasons:

Maintenance: You need to reboot or patch a DC, and want clients to use another one during the window.
Performance: A particular DC is overloaded, and you want to distribute the load.
Decommissioning: You are retiring an old server and need to move all clients to the replacement.
Troubleshooting: A DC is misbehaving (e.g., replication errors) and you want to test if the issue is client-specific.
Network changes: You moved a client to a different subnet and want it to use a local DC instead of a distant one.

In most cases, you don’t need to do anything manually. Windows clients and servers automatically discover the closest available DC using DNS. However, there are scenarios where manual intervention is required or preferred.

How Domain Controller Discovery Works

Computers in an Active Directory domain find a DC using the Domain Controller Locator (DC Locator) process. This is a DNS-based discovery mechanism that works as follows:

The client queries DNS for SRV records that advertise domain controllers. For example, _ldap._tcp.dc._msdcs.contoso.com returns a list of DCs.
The client sorts the results by site, preferring DCs in the same Active Directory site as the client.
The client then tries each DC in order, using a ping (ICMP) and LDAP ping to find one that responds.
The first DC that responds successfully is used for authentication and directory lookups.

This process runs every time a user logs on, and also periodically for background tasks like Group Policy refresh. The result is cached in the LsaCache registry key, but it is refreshed frequently.

Methods to Switch Domain Controllers

There are several ways to force a client to use a specific DC:

Change DNS settings: The most direct method. On the client’s network adapter, set the preferred DNS server to the IP address of the DC you want to use. This works because DC discovery starts with a DNS query. If the DNS server only returns that DC’s SRV records, the client will use it.
Use the nltest command: nltest /server:<DCName> /sc_query:<domain> shows the current DC. To force a change, you can use nltest /sc_reset:<domain>\<DCName> to reset the secure channel to a specific DC. This is often used for troubleshooting.
Use the set command in a command prompt: set logonserver=<DCName> only affects the current session’s environment variable, not the actual DC used. This is not a valid method.
Reboot the client: A reboot forces a fresh DC discovery. This is the simplest way to clear a cached DC, but it is disruptive.
Use Group Policy: You can assign a specific DC for certain services, but this is not a general client switch.

The most common and reliable method is to change the DNS server on the client. This is because the DC Locator relies on DNS. If the client’s DNS points to a server that only knows about one DC, that DC will be used.

How to Switch a Client to a Specific DC (Step-by-Step)

Here is the typical process for a Windows client:

Open Control Panel > Network and Sharing Center > Change adapter settings.
Right-click your active network adapter and select Properties.
Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
Choose Use the following DNS server addresses.
Enter the IP address of the DC you want to use as the Preferred DNS server.
Click OK and close all windows.
Open a command prompt and run ipconfig /flushdns to clear the DNS cache.
Run nltest /dsgetdc:<domain> to verify the new DC is being used. The output will show the DC name.

If you are switching a server that hosts a specific role (like a file server or DHCP), you may also need to update the service’s configuration to point to the new DC.

Common Problems and How to Avoid Them

Switching DCs can cause issues if not done carefully:

DNS misconfiguration: If you point a client to a DNS server that is not authoritative for the domain, the client may not find any DC. Always use a DNS server that hosts the domain’s zones.
Site topology: If you manually force a client to use a DC in a different site, you may experience slower authentication and increased network traffic. This is because the client will not use the site-aware discovery.
Replication latency: If you switch to a DC that has not yet replicated recent changes (e.g., a new user account), you may see authentication failures. Wait for replication to complete or force replication.
Time skew: Kerberos authentication requires the client and DC clocks to be within 5 minutes of each other. If the new DC has a different time source, you may get clock skew errors.
Secure channel issues: If the computer account’s password is out of sync with the new DC, you may get “trust relationship” errors. This is rare but can happen if the DC is restored from backup.

Switching Domain Controllers for Domain Join and Trusts

When you join a computer to a domain, you can specify a particular DC by using the netdom join command with the /DC: parameter. For example:

netdom join %computername% /domain:contoso.com /DC:DC01 /UserD:administrator /PasswordD:*

This is useful when you have a specific DC that you want to handle the join. Similarly, when creating a trust between domains, you can specify a DC using the netdom trust command with the /DC: parameter.

Frequently Asked Questions

How do I check which domain controller I’m currently using?

Open a command prompt and run echo %logonserver% to see the DC that authenticated your current session. For a more comprehensive view, use nltest /dsgetdc:<domain> which shows the DC that the locator process would return.

Does changing the DNS server on a client affect other services?

Yes, DNS is used for many things beyond DC discovery. If you change the DNS server, the client will use that server for all name resolution. Ensure the new DNS server can resolve internal names as well as external internet names, or the client may lose internet access.

Can I force a DC switch without rebooting?

Yes, you can use nltest /sc_reset:<domain>\<DCName> to reset the secure channel to a specific DC. This will cause the client to use that DC for the next authentication. However, some services may cache the DC for longer, so a reboot is the most reliable way.

What happens if the DC I switch to goes down?

If the DC you manually forced becomes unavailable, the client will fail to authenticate until it retries discovery. The DC Locator process will eventually try another DC, but this may take a few minutes. To avoid this, always ensure at least one other DC is reachable and that DNS records are healthy.

Is it better to let Windows automatically pick a DC?

In most cases, yes. The automatic process is designed to find the closest, most responsive DC. Manual switching should be reserved for maintenance, troubleshooting, or specific scenarios where you need to control the DC used. Overriding the automatic process can lead to performance issues if you pick a distant DC.

Does switching DCs affect Group Policy?

Group Policy is processed from the DC that the client authenticates with. If you switch to a different DC, the client will pull Group Policy from that DC. Ensure the new DC has the latest Group Policy objects replicated to it, otherwise you may see outdated policies.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.