What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This error means the Active Directory PowerShell client could not find or reach a domain controller that can handle its request through Active Directory Web Services (ADWS). It does not, by itself, prove that ADWS is stopped: the selected controller may be unsuitable, unavailable, or unreachable from the client. Start by identifying the domain controller the client is using and checking its connectivity before changing server settings.
What the error means
ADWS is a service on a server that provides a web-service interface to Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), and Active Directory Database Mounting Tool instances on that same server. The Active Directory module for Windows PowerShell and Active Directory Administrative Center use ADWS to manage those directory instances. If the service is unavailable, those clients cannot manage them through ADWS.
As an Amazon Associate I earn from qualifying purchases.
A Windows 11 laptop or other workstation is typically the management client, not the machine that should host ADWS. Microsoft says the AD DS or AD LDS server role installs ADWS automatically on Windows Server 2008 R2 and later. Do not try to install ADWS on a client laptop or add server roles there to resolve this message. Microsoft’s ADWS startup guidance
Free tools Windows power users keep installed
One-click scans. No signup required.
Diagnose the client-to-domain-controller path
Run the initial checks on the computer where the failing PowerShell command runs. Record the domain and domain controller involved, then distinguish a name-resolution or connectivity problem from a server-service problem.
#1 Best Overall
- Identify the target domain controller. Check the command’s server setting, if one is specified, and determine which controller the request is targeting when it is not. A failure against one controller does not establish that all controllers are affected.
- Check name resolution and basic reachability. Confirm that the controller’s name resolves to the expected address and that the host is reachable from the client. If either check fails, investigate the client’s DNS configuration, network path, and server availability before changing ADWS settings.
- Test TCP port 9389. From the affected client, check whether TCP 9389 is reachable on the target controller. Microsoft’s Windows Server 2008 R2 ADWS documentation identifies TCP 9389 as the required port and notes that a firewall Group Policy may need to be updated. This is a version-contexted legacy reference, not a complete current firewall policy for every environment. Microsoft’s ADWS overview
- Try a known-good controller explicitly. Where the failing cmdlet supports it, use its
-Serverparameter to target a known-good domain controller. If that works, investigate the original controller selection or that individual server’s state. A successful test is a clue, not proof of a single root cause.
A recent third-party troubleshooting guide also suggests using Get-ADDomainController -Discover -Service ADWS to look for a controller advertising ADWS. Confirm that this syntax is supported by the Active Directory module version installed in your environment. TheITBros troubleshooting guide
Check ADWS on the domain controller
If the controller is reachable but the ADWS test or PowerShell request still fails, have an administrator check the service on that domain controller. Microsoft’s documented graphical procedure is:
- On the domain controller, open
services.mscwith appropriate administrative access. - Find Active Directory Web Services in the services list.
- Open its properties and set Startup type to Automatic.
- If the service is not running, select Start, then retry the original operation from the client.
Apply service and firewall changes through your organization’s normal change process. Do not disable the firewall wholesale; identify and permit the required traffic under the applicable policy. Microsoft’s current guidance covers configuring ADWS to start automatically on servers. Configure ADWS to start automatically
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse the result to choose the next step
| What you observe | Likely area to investigate | Next step |
|---|---|---|
| The controller name does not resolve or the host is unreachable | Client DNS, network path, or controller availability | Resolve name and host reachability problems before changing ADWS. |
| Host is reachable, but TCP 9389 is not | ADWS availability, server state, or a host/network firewall rule | Check the service on the controller and ask the network or directory administrator to review the relevant firewall policy. |
| An explicitly named known-good controller works | Original controller selection or the individual controller | Investigate why the original request selected that controller and check its health and ADWS service. |
| Multiple controllers are reachable on TCP 9389, but the command still fails | The cause is not established by reachability alone | Check the cmdlet’s target and module syntax, then involve the directory administrator to investigate the affected servers and request. |
Older Windows Server versions
Microsoft’s legacy documentation describes the Active Directory Management Gateway Service as an ADWS-equivalent option for Windows Server 2003 and 2008 systems. That historical guidance should not be applied to current server versions without checking the documentation for the specific operating system and your organization’s support policy. The Windows Server 2008 R2 port and service references above likewise should be read in their documented version context, rather than as a complete compatibility guide.
Rank #3
When to involve an administrator
If you only have access to the Windows client, you can gather the target controller, name-resolution and reachability results, TCP 9389 status, and whether an explicitly named controller works. Service startup and firewall policy changes require access to the domain controller or network controls. Send those findings to your directory or network administrator rather than installing server components on the workstation.
Quick Recap
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
