🟠 High   ⏱ 5–30 min  Last verified: 30 May 2026
Affected versions: Windows Server 2016

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution — Primary Fix
  7. Solution — Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Domain management protocols are blocked because server applies Public profile rules.

Environment & Reproduction

Happens when NLA cannot identify domain connectivity after startup.

Get-NetConnectionProfile
Get-NetFirewallProfile

Root Cause Analysis

Network Location Awareness starts before DNS/DC reachability and misclassifies network.

Quick Triage

Confirm DC connectivity and NLA service state during startup window.

Test-NetConnection dc01.contoso.local -Port 389
Get-Service NlaSvc,Netlogon

Step-by-Step Diagnosis

Review NLA and firewall events for profile transitions.

Get-WinEvent -LogName 'Microsoft-Windows-NlaSvc/Operational' -MaxEvents 80
Get-WinEvent -LogName System -MaxEvents 80
Illustrative mockup for windows-server-2016 — terminal_or_powershell
Firewall profile diagnostics — Illustrative mockup — Progressive Robot

Solution — Primary Fix

Ensure domain services start order is correct and restart NLA after network readiness.

Still having issues? Our Network Design team can diagnose and resolve this for you. Get in touch for a free consultation.

Set-Service NlaSvc -StartupType Automatic
Restart-Service NlaSvc
Restart-Service Netlogon
Illustrative mockup for windows-server-2016 — event_or_log_viewer
Firewall profile transition events — Illustrative mockup — Progressive Robot

Solution — Alternative Approaches

Create temporary scoped firewall allow rules for domain controller traffic.

New-NetFirewallRule -DisplayName 'Allow AD Core Ports' -Direction Outbound -Protocol TCP -RemotePort 53,88,135,389,445 -Action Allow

Verification & Acceptance Criteria

Profile remains DomainAuthenticated after reboot and management traffic succeeds.

Get-NetConnectionProfile
Test-NetConnection dc01.contoso.local -Port 445

Rollback Plan

Remove temporary broad rules once profile stability is confirmed.

Remove-NetFirewallRule -DisplayName 'Allow AD Core Ports'

Prevention & Hardening

Add startup dependency checks and monitor profile drift in operations tooling.

Get-NetConnectionProfile | Export-Csv C:Tempprofiles.csv -NoTypeInformation

Related to delayed Group Policy processing and secure channel warnings.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft documentation on NLA behavior and firewall profile selection.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.