Windows Server · Windows  ·  high  ·  Roles & shared services

Event 5719 — no domain controller available for the domain

Netlogon could not find a DC when it needed one. At startup this is usually a race with the network coming up; at other times it is a real DC location failure.

What you see

Event 5719 in the System log, often paired with Group Policy 1129. Sometimes only at boot with no user impact, sometimes with sign-in failures.

What is actually wrong

The network stack is not ready when Netlogon starts, DNS is pointing at the wrong resolver, a VPN or teamed NIC is slow to initialise, or the site topology has no DC in the client's subnet.

Codes and articles

5719Event 5719Event 1129NETLOGONno Domain Controller is available

Start here — find out which fix applies

A script that runs the 1 inspection command from the write-up below and prints what each one returned. It reads the machine and changes nothing — every command that could write, delete, start or stop is excluded from it by construction. Run this first, then pick the fix its output points at.

Download the read-only diagnosticchanges nothing · safe to run before reading

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Fixes (2)

Make the machine wait for the network before logging on
Elevated PowerShell20 minuteslow riskreversible

Only at startup, with no impact afterwards. This is a race, not a fault.

  1. Confirm the event only ever appears within a minute of boot.

    PowerShell
    Get-WinEvent -FilterHashtable @{LogName='System'; Id=5719} -MaxEvents 20 | Format-Table TimeCreated, Message -AutoSizeGet-WinEvent -FilterHashtable @{LogName='System'; Id=6005} -MaxEvents 5 | Format-Table TimeCreated

    Event 6005 is the event log starting, which is as close to boot time as you get. If every 5719 lands within a minute of a 6005, it is the race.

  2. Turn on Always wait for the network at computer startup and logon in Group Policy, under Computer Configuration → Administrative Templates → System → Logon.

    PowerShell
    New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name 'SyncForegroundPolicy' -Force -ErrorAction SilentlyContinueSet-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon' -Name SyncForegroundPolicy -Value 1 -Type DWord

    It costs a few seconds of boot time and removes a whole class of intermittent policy and drive-mapping failures.

  3. Disable NIC power saving, which delays link-up on wake.

    PowerShell
    Get-NetAdapter | ForEach-Object { Set-NetAdapterPowerManagement -Name $_.Name -AllowComputerToTurnOffDevice Disabled -ErrorAction SilentlyContinue }

  4. On a Wi-Fi machine, enable the machine-account authentication option so the network is up before sign-in.

Confirm it worked5719 stops appearing on subsequent restarts.
If you need to undo itSet SyncForegroundPolicy back to 0.
Download this fix as a PowerShell script1 step you do yourself · asks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Repair DC location
Elevated PowerShell40 minuteslow riskreversible

It happens outside of boot, or users are seeing failures.

  1. Ask the machine to locate a DC and show its reasoning.

    PowerShell
    nltest /dsgetdc:example.local /forcenltest /dsgetsite

  2. Check the DNS servers configured — a public resolver here breaks DC location entirely.

    PowerShell
    Get-DnsClientServerAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, ServerAddresses -AutoSize

  3. Confirm the SRV records exist.

    PowerShell
    Resolve-DnsName -Name _ldap._tcp.dc._msdcs.example.local -Type SRV | Format-Table Name, NameTarget, Port -AutoSize

  4. Check the client's subnet is defined in Sites and Services — an undefined subnet sends clients to a random site.

    PowerShell
    Get-ADReplicationSubnet -Filter * | Format-Table Name, Site -AutoSize

    A missing subnet definition makes clients authenticate across a WAN link to whichever DC answers first, which produces intermittent 5719s and slow logons that look like a network fault.

  5. Add the missing subnet.

    PowerShell
    New-ADReplicationSubnet -Name '10.20.0.0/24' -Site 'Branch-Office'

  6. Reset the secure channel if it is broken.

    PowerShell
    Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Confirm it workednltest /dsgetdc returns a DC in the expected site, quickly.
PowerShell
nltest /dsgetdc:example.local
If you need to undo itRemove-ADReplicationSubnet for anything you added in error.
Download this fix as a PowerShell scriptasks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Related faults

DNS event 4013 — waiting for Active Directory to signal it has completed initial synchronisationWindows ServerSYSVOL not shared, or Group Policy files missing on one controllerWindows ServerAD replication error 8524 — the DSA operation cannot continue (DNS lookup failure)Windows Server

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.