Windows Server 2019 — Netlogon service breaks secure channel with PDC emulator — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Netlogon on Windows Server 2019 reports a broken secure channel, so domain authentication fails on the member server. Users see trust relationship errors at logon, services running under domain accounts fail to start, and Group Policy stops applying.

Environment & Reproduction

Reproduce after long offline periods, restored snapshots, or password resets on the computer account. Inspect Netlogon.log and System log.

Get-Service -Name netlogon
Get-WinEvent -LogName System -MaxEvents 40
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Root Cause Analysis

Causes include computer account password drift, time skew beyond the Kerberos tolerance, restored VM snapshots, or stale cached credentials.

Quick Triage

Capture secure channel state and time offset against the PDC emulator before changes.

sc.exe query netlogon
Get-Service -Name netlogon | Select-Object Status,StartType
Get-EventLog -LogName System -Newest 30 | Where-Object {$_.Source -match 'netlogon'}

Step-by-Step Diagnosis

Test the secure channel state, check time offset, and read Netlogon events.

Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.ProviderName -match 'netlogon'} | Select TimeCreated,Id,LevelDisplayName,Message
sc.exe qfailure netlogon
sfc /verifyonly

Solution — Primary Fix

Reset the computer account password from the affected host using Test-ComputerSecureChannel -Repair and reboot.

Restart-Service -Name netlogon -Force
Get-Service -Name netlogon | Select-Object Status,StartType
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object {$_.ProviderName -match 'netlogon'}

Solution — Alternative Approaches

If reset fails, rejoin the domain with the same name to restore a clean computer account.

sc.exe config netlogon start= auto
sc.exe failure netlogon reset= 86400 actions= restart/60000/restart/60000/run/1000
Restart-Service -Name netlogon -Force

Verification & Acceptance Criteria

Secure channel reports healthy, domain logons succeed, and Group Policy applies without trust errors.

Get-Service -Name netlogon
Get-WinEvent -LogName System -MaxEvents 25 | Where-Object {$_.ProviderName -match 'netlogon' -and $_.LevelDisplayName -eq 'Error'}
Test-NetConnection -ComputerName localhost -Port 

Rollback Plan

Restore the prior computer account state from backup if the rejoin or reset removes needed permissions.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
wbadmin get versions
# Restore previous configuration export if available

Prevention & Hardening

Avoid restoring DC snapshots, keep time in sync via authoritative NTP, and monitor secure channel health.

Get-Service -Name netlogon | Export-Clixml C:/Temp/netlogon-baseline.xml
Get-WinEvent -LogName System -MaxEvents 50 > C:/Temp/netlogon-events.txt
Get-ScheduledTask | Where-Object {$_.TaskName -match 'netlogon'}

Related Errors & Cross-Refs

Related to events 5719, 3210, and Kerberos KRB_AP_ERR_TKT_EXPIRED.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn references for Netlogon and secure channel troubleshooting on Windows Server 2019.