How to fix Error 1265 on Windows 11

by

Windows 11 Troubleshooting Guide: Error 1265 – “The system cannot contact a domain controller to service the authentication request”

Why This Error Happens

Error 1265 occurs when a Windows 11 client attempts to authenticate against Active Directory but cannot locate or communicate with a domain controller (DC). This is typically caused by DNS misconfiguration (the client cannot resolve SRV records for the domain), network connectivity issues (firewall blocking LDAP/Kerberos ports 389, 88, 445, 53), or a broken secure channel trust between the workstation and the domain due to an expired or corrupted machine account password. Time synchronization drift beyond the 5-minute Kerberos tolerance can also trigger this failure even when connectivity is otherwise fine.

Step-by-Step Resolution Guide

  1. Verify DNS Configuration
  • Open Settings > Network & Internet > Ethernet/Wi-Fi > Edit DNS settings.
  • Ensure the DNS server points to your internal Active Directory DNS server (not a public DNS like 8.8.8.8).
  • Run ipconfig /flushdns and ipconfig /registerdns in an elevated Command Prompt.
  1. Test Domain Controller Connectivity
  • Open PowerShell as Administrator and run:

    nltest /dsgetdc:yourdomain.com
  • If this fails, run Test-NetConnection -ComputerName <DC-IP> -Port 389 to confirm LDAP port access. If blocked, check Windows Defender Firewall or network firewall rules between subnets.
  1. Check and Fix Time Synchronization
  • Run w32tm /query /status to check the time source.
  • Resync with:

    w32tm /resync /force
  • Ensure the client’s time is within 5 minutes of the DC.
  1. Repair the Secure Channel Trust
  • In an elevated PowerShell session, run:

    Test-ComputerSecureChannel -Verbose
  • If it returns False, reset it using:

    Reset-ComputerMachinePassword -Server <DC-Name>
  • Alternatively, use netdom resetpwd (from RSAT tools) if a Domain Admin credential is available.
  1. Restart the Netlogon Service
  • Open services.msc, locate Netlogon, right-click and select Restart.
  • Alternatively, run in an elevated Command Prompt:

    net stop netlogon && net start netlogon

Alternative or Verification Steps

  • After completing the steps, run nltest /sc_verify:yourdomain.com — a successful response confirms the secure channel is restored.
  • If the issue persists, disjoin the machine from the domain, restart, then rejoin via System Properties > Computer Name > Change, using a fresh set of domain credentials.