Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Netlogon events 5774, 5775, and 5781 report failures to register or remove one or more DNS records. They do not, by themselves, prove that a domain controller is broken or that Active Directory replication has failed. The record name, DNS server, and response code in the full event are the best clues to the cause.
JSI Tip 3124 is a Windows 2000-era article, published by Jerold Schulman on December 6, 2000. Its central explanation—failed dynamic DNS updates—still helps frame the problem, but current troubleshooting should use modern DNS checks and tools such as dcdiag and nltest. Read the archived JSI Tip 3124.
What the events mean
In this context, DDNS means dynamic DNS updates: a computer asks a DNS server to add, refresh, or remove a record. Netlogon uses dynamic DNS to publish records that help clients and other domain controllers locate Active Directory services. The original JSI Tip describes these event IDs as follows:
| Event | Meaning | Possible effect |
|---|---|---|
| 5774 | A DNS record registration failed. | A required record may be missing or stale. |
| 5775 | A DNS record deregistration failed. | An obsolete record may remain in DNS. |
| 5781 | One or more dynamic DNS registrations or deregistrations failed. | One or more records may not reflect the domain controller’s current state. |
These are symptoms, not root-cause diagnoses. Read the entire event and note the record name and type, the address being registered, the DNS server that handled the request, and any returned RCODE or status code. An event naming an LDAP SRV record points to a different record than one naming a host A or PTR record; the server response helps distinguish an unreachable target from a refused or unauthorized update.
#1 Best Overall
Why DNS registration matters to Active Directory
Domain controllers publish host records and service-location records, including SRV records for LDAP and Kerberos and records used to locate Global Catalog services and forest-wide domain controllers under _msdcs. Clients use these records to find a suitable domain controller. Missing or incorrect locator records can disrupt discovery, authentication, or directory-service access, though a single registration warning does not establish that any of those functions have failed.
Microsoft says Netlogon normally registers its records when the domain controller or Netlogon starts and periodically afterward—approximately once an hour. That retry behavior may clear a transient failure, but recurring events need investigation. Microsoft’s guidance on preventing domain-controller DNS records from registering describes this behavior and the related configuration.
Troubleshoot in order
- Capture the full event. Write down the timestamp, failed record, record type, address, DNS server, and response/status code. Note whether the event reports registration or deregistration and whether it repeats. Do not begin by restarting Netlogon; that triggers another attempt but does not correct a bad DNS configuration or update permission.
- Check the domain controller’s DNS client settings. Run
ipconfig /allin an elevated Command Prompt. Review the DNS servers, suffixes, and every network adapter, including VPN, virtual, storage, or backup interfaces. A domain controller should normally use internal DNS servers that host or can resolve its AD zones—not an ISP or public resolver as its direct DNS client. Configure external forwarders on internal DNS servers when needed. The right internal-server arrangement depends on the domain’s topology. See Microsoft’s domain-controller DNS guidance. - Test the server named in the event. Confirm that the DNS server is reachable and that it can answer for the relevant zone. For example:
nslookup -type=SRV _ldap._tcp.dc._msdcs.example.com <DNS-server>Replace the example domain and server with your own. A successful ping does not prove DNS updates will work: routing, firewall rules, DNS service health, or access controls can still block requests. DNS may use UDP or TCP, so check the relevant network path rather than relying on ICMP alone.
- Confirm the correct zone is authoritative and available for updates. A server configured as a resolver may not host the zone, and a request may be directed to a secondary or otherwise read-only server. Check the domain zone and, where applicable, the separate or integrated
_msdcszone, along with delegations and forwarding. If the event names an external server, investigate how the domain controller selected it; do not try to make an unrelated public resolver accept an AD update. - Check the zone’s dynamic-update policy and record permissions. In DNS Manager, inspect the relevant zone’s properties. For a suitable Active Directory-integrated zone, Microsoft recommends secure dynamic updates; the available choices include None, Nonsecure and secure, and Secure only. A secure update can fail when an existing record is owned by another computer account or was created manually, by DHCP, or by a retired domain controller. Look for stale addresses, duplicates, incorrect ACLs, and conflicting records. Do not switch to nonsecure updates simply to silence the event; that weakens protection against unauthorized changes. See Microsoft’s dynamic-update troubleshooting guidance.
- Run the DNS diagnostic. From an elevated prompt, run:
dcdiag /test:dns /v /s:<DCName> /DnsDynamicUpdateReplace
<DCName>with the domain controller’s name. This test includes basic checks and tests whether dynamic updates are enabled in the AD zone. For a broader review, usedcdiag /test:dns /v /s:<DCName> /DnsAll, ordcdiag /test:dns /v /s:<DCName>for the general DNS test. Review the reported failure rather than treating the command’s overall result as a diagnosis. See Microsoft’s DNS verification procedure and thedcdiagreference. - Check the DNS server’s own evidence. The domain controller’s event may be less specific than the DNS server’s logs. Inspect the DNS server’s System log and relevant DNS audit records. Microsoft identifies audit event 519 as useful for tracking dynamic-update activity; check the server that handled the request. This can help establish whether the update was accepted, rejected, modified, or deleted.
- Correct the cause, then request registration again. For Netlogon’s domain-controller locator records, use:
nltest /dsregdnsAlternatively, restart Netlogon to trigger registration:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.net stop netlogon net start netlogonFor the host’s DNS Client registration, use:
ipconfig /flushdns ipconfig /registerdnsipconfig /registerdnsis not a universal fix for every DHCP client; it addresses host-record registration and is distinct from Netlogon’s locator-record registration. Microsoft documents these commands in its DNS verification guidance. - Verify the result. Query the authoritative server for the exact record named in the event, rerun the relevant
dcdiagtests, and monitor the System log for recurrence. If records had been missing, also check domain-controller discovery and directory replication before concluding the environment is healthy.
Common causes and special cases
- Wrong DNS client server: A DC points to a public resolver, ISP server, firewall, or other server that cannot update its AD zone. Use internal AD-aware DNS for the DC; configure external resolution through internal DNS forwarders.
- Zone or delegation problem: The target does not host the zone, dynamic updates are disabled, a delegation points elsewhere, or the request reaches a server that cannot accept writes.
- Secure-update ownership conflict: A stale or manually created record is owned by a different principal. Deleting and recreating it may resolve ownership, but can temporarily remove a locator record; plan the change and verify DNS replication afterward.
- Multiple adapters: A multi-homed DC may register an address that clients cannot reach or publish unnecessary records. Identify which interfaces and addresses belong in DNS; do not blindly register every adapter.
- DHCP involvement: Static-IP domain controllers should not normally depend on DHCP to maintain their critical locator records. For ordinary clients, DHCP and client registration can interact, so design record ownership deliberately rather than changing update settings indiscriminately.
- Scavenging: Scavenging can remove records considered stale, but disabling it across the board is not a safe first response. Check timestamps, refresh behavior, ownership, and the zone’s scavenging design.
- IPv6-related test result: Microsoft notes that the AAAA portion of a
dcdiagDNS test may fail normally when IPv6 is not enabled. Interpret that result in the context of the system rather than treating it alone as proof of DNS failure. - Single-label domain: Legacy domains named with a single label, such as
INTRANET, have special requirements and can encounter recurring Event 5781 issues. Do not assume the normal fully qualified domain-name guidance applies; consult Microsoft’s guidance on single-label DNS names.
Should you disable Netlogon dynamic DNS?
Usually, no. Microsoft documents the UseDynamicDns value at HKLMSystemCurrentControlSetServicesNetlogonParametersUseDynamicDns; its default is 1. Setting it to 0 disables Netlogon’s dynamic registration. That is an intentional design choice only when an organization manages all required records manually or uses a DNS platform that cannot accept dynamic updates—not a general fix for failed registration. The records in netlogon.dns must then be maintained manually, and missed changes can impair domain-controller discovery. Back up the relevant configuration and plan a rollback before changing the registry. See Microsoft’s documentation.
Know when the issue is resolved
Confirm that the specific record exists with the correct value on the authoritative DNS server, the relevant dynamic-update tests pass, and the events do not recur. If the original problem involved missing locator records, check that clients can locate a domain controller and review replication with repadmin /replsummary or repadmin /showrepl. You can also test DC discovery with nltest /dsgetdc:<domain>. A cleared event alone does not prove that DNS, authentication, or replication is fully healthy.
Netlogon records registered through dynamic DNS have a documented default TTL of 10 minutes; that TTL is separate from the approximate hourly refresh behavior. Microsoft’s dynamic DNS documentation explains update behavior. Base the fix on the failed record and server response, not on the event number alone.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
