How does Windows find/discover the Domain Controller when you log in?

I've added a new DC to my domain as a backup, but I'm not sure how the computers will know to look for it, as I don't quite understand the process of how Windows domain login works from a protocol point of view.


When you promote a domain controller, it's added to the DNS srv records. If you drill down through the _msdcs section in DNS, you'll see a bunch of stuff that looks like this:

enter image description here

This link joeqwerty included in a comment provides a more detailed description. An excerpt:

The first step is to perform the DNS discovery. The client issues a DNS request for _ldap._tcp.dc._msdcs.mockup1.contoso. com The DNS server returns a list of SRV records that match this request. If no records are available, then the domain location fails. The DNS exchange is done as specified in the DNS protocols (RFC 1769 and related RFCs). If target hosts have the same priority, the client select a return SRV record according to weighted pseudorandom order (see RFC2052).

The client then resolves the SRV record to an address, again as specified in the DNS protocols.

Once the address is known, the client sends an LDAP “Ping,” as a way of detecting that the domain controller is in fact handling requests and determining the characteristics of this domain controller. The LDAP “Ping” also known as connectionless LDAP is sent over UDP

  • Ahh OK - so I just need to ensure all clients have the backup domain controller set as one of the two DNS servers (i.e. in DHCP or IPv4 NIC settings) and I should be OK? – NickG Jan 6 '16 at 20:38
  • You should be okay regardless. All the (Active Directory Integrated) DNS servers should know about all the domain controllers. – Katherine Villyard Jan 6 '16 at 20:47
  • I really meant allowing people to log in if the primary DC failed... If the backup wasn't a DNS server and/or the clients weren't configured to use it, it would presumably be impossible to log in as the clients wouldn't have a way to "know" there is another DC? – NickG Jan 6 '16 at 20:58
  • Yes, you'd need back up DNS as well, so yes, go ahead and set the new DC as a second DNS server on the clients. – Katherine Villyard Jan 6 '16 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.