How to fix Error 1351 on Windows 11

by

Troubleshooting Guide: Error 1351 – Configuration Information Could Not Be Read from the Domain Controller

Why This Error Happens

Error 1351 typically occurs when a Windows 11 client cannot properly communicate with Active Directory due to DNS resolution failures, expired or misconfigured Kerberos tickets, or a broken secure channel trust between the workstation and the domain controller. It can also stem from insufficient permissions on the computer account object within Active Directory, or from network-level blocks such as firewall rules preventing LDAP (port 389) or RPC (port 135) traffic from reaching the domain controller.

Step-by-Step Resolution Guide

Step 1: Verify Network and DNS Connectivity

  • Open Command Prompt as Administrator and run nslookup <domaincontroller.domain.com> to confirm DNS resolution is working.
  • Run ping <domain controller IP> to rule out basic network unavailability.
  • Ensure the Windows 11 machine’s DNS settings point to the internal DNS server (usually the DC itself), not a public DNS like 8.8.8.8.

Step 2: Repair the Secure Channel Trust

  • Open PowerShell as Administrator.
  • Run Test-ComputerSecureChannel -Verbose to check if the trust relationship is broken.
  • If it returns False, repair it with: Test-ComputerSecureChannel -Repair -Credential (Get-Credential).
  • Enter domain admin credentials when prompted to re-establish the trust.

Step 3: Check Firewall and Port Accessibility

  • Confirm that Windows Defender Firewall (or any third-party firewall) is not blocking essential AD ports: 389 (LDAP), 636 (LDAPS), 88 (Kerberos), and 135 (RPC).
  • Temporarily disable the firewall for testing purposes only, using netsh advfirewall set allprofiles state off, then re-test the connection.
  • Re-enable the firewall afterward and create specific inbound/outbound rules for AD traffic if disabling resolved the issue.

Step 4: Validate Computer Account Permissions in Active Directory

  • On a domain controller, open Active Directory Users and Computers (ADUC).
  • Locate the affected computer object, right-click, and select Properties.
  • Under the Security tab, ensure “Authenticated Users” and “SELF” have appropriate read/write permissions.
  • If the object appears corrupted or orphaned, consider removing it from the domain and rejoining the machine.

Step 5: Rejoin the Domain (If Trust Cannot Be Repaired)

  • Sign in locally using a local administrator account.
  • Navigate to Settings > Accounts > Access work or school, remove the domain connection.
  • Restart the PC, then rejoin the domain via Settings > System > About > Domain or workgroup.
  • Restart again to apply the new secure channel trust.

Alternative or Verification Steps

  • After completing the steps above, run gpupdate /force and check the Event Viewer (under Windows Logs > System) to confirm Error 1351 no longer appears.
  • If the issue persists, use dcdiag /v on the domain controller to identify deeper AD replication or DNS zone issues that may be triggering the error at a server level rather than a client level.