In general, these events indicates that the machine is unable to register its records with the DNS server it’s configured.
- An ISP’s DNS server, or the router’s IP address, is set to be used as a DNS server in NIC properties.
- The AD zone is configured to not allow dynamic updates.
- If the 1st DNS entry is in another site, a firewall may be blocking necessary traffic.
- Altered default security settings on the zone.
- Altered default security settings in AD.
- Altered default security settings on C: drive or C:\Windows folder.
- Antivirus not configured to allow domain communications and services exceptions. See the antivirus vendor documentation on how to configure DCs for exclusions.
- If the zone is set to Secure Only, possible Kerberos authentication errors will prevent registration. Causes of Kerberos errors can be numerous including misconfigured time service and antivirus exclusion, using an ISP’s DNS, third party installed firewalls or AV, and more.
Note on Firewalls
Active Directory communications require over 29 ports to be allowed, plus the ephemeral ports, and differ among operating system versions:
- Windows 2003, Windows XP and older: UDP 1024 – 5000
- Windows 2008, Windows Vista, & newer: UDP 49152 – 65536
DNS updates require TCP 53 & UDP 53, not just TCP 53.
It can be extremely challenging to configure a firewall for AD communications/ General rule of thumb is to just allow all traffic between locations.
Here’s a good list of the ports:
Active Directory Firewall Ports – Let’s Try To Make This Simple (RODC, too)
If you need to control the ports AD uses across a firewall:
Active Directory Replication over Firewalls
Paul Bergson’s Blog on AD Replication and Firewall Ports
Restricting Active Directory replication traffic and client RPC …Restricting Active Directory replication traffic and client RPC traffic to a … unique port, and you restart the Netlogon service on the domain controller. …
How to restrict FRS replication traffic to a specific static port – How to restrict FRS replication traffic to a specific static port … Windows 2000-based domain controllers and servers use FRS to replicate system policy …
You can run the following tests on AD to ensure there are no errors:
- DCDIAG /V /C /D /E /s:yourDCName > c:\dcdiag.log
- Netdiag.exe /v > c:\netdiag.log (Run only on each Windows 2003 or older DCs, not 2008 or 2008 R2)
- repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt
- ntfrsutl ds domain.com > c:\sysvol.log
- On the machine logging the above event, in their TCP/IP configuration, make sure they’re not configured for the same DNS server for both Primary and Secondary.
- The following registry value is incorrect: “SiteCoverage” under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
This value typically should equal the domain name.
- You can try to flip the zone types to reset default settings.
- Change the zone type from Active Directory integrated to “Standard Primary”, then stop & start DNS.
- Then stop & start the netlogon service on the child DC & verify that the records are registered.
- If verified, then change the zone type back to Active Directory integrated and verify that the DC no longer records the Event log errors when the netlogon service is stopped & started.
- Make sure the machine logging the above event is pointing to a DNS server that support Dynamic updates and is hosting a zone for the domain (i.e. make sure it’s not pointing to the ISPs DNS server).
- Verify if there is no manually created CNAME, A or other record) for the same hostname. If there is, it will prevent the DCs from dynamically registering its host and you need to remove the manually created record.
- In a Parent – Child delegated scenario, and Event ID 5774 was logged on the domain controllers in the child domain:
On the parent DNS servers, there is a delegation for the child DNS servers. The child DNS servers have forwarders up to the parent DNS servers.
Cause and Fix:
On the Security tab in the delegations, check if “Authenticated Users” is missing.
Added “Authenticated Users” and enabled Full Control.
Domain Controller Generates a Netlogon Error Event ID 5774
A DNS Update is recorded as failed: Event ID 5774, 1196, or 1578
This problem occurs when you use a third-party server application for DNS resolution. This includes SCCM causing false alarms, and cluster resources not initiating using a third party DNS server.
Hotfix available for Windows Server 2008 R2 or Windows 7.
Event ID: 5774 Source: NETLOGON
Technet thread: “Event 5774, NETLOGON” Friday, November 20, 2009
Technet thread: “Netlogon event 5774” Tuesday, February 01, 2011
I hope this helps with figuring out and fixing an Event ID 5774.
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP – Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.