What does NTSTATUS 0xC00000DC (STATUS_INVALID_SERVER_STATE) mean?

 
Previous Next
STATUS_CANT_TERMINATE_SELF STATUS_INVALID_DOMAIN_STATE

STATUS_INVALID_SERVER_STATE

A domain controller shutdown path is a documented producer of this state

STATUS_INVALID_SERVER_STATE is more specific than a generic server failure. Microsoft documents a domain-controller shutdown scenario in which a DC normally returns this status to current Netlogon clients so that they stop using the shutting-down controller and locate another one. That makes the server lifecycle state and the client's DC-selection cache central evidence.

The documented failure mode is subtle: a controller can already be shutting down while still answering new Netlogon UDP queries. A client can then select it again, receive the state failure, and repeat the selection cycle. DC Locator and DsGetDcName maintain discovery and cached-controller behavior, so a trace should distinguish the DC that was selected, the DC that rejected the operation, and whether rediscovery actually selected a different controller.

Do not diagnose this status as a bad password or damaged account database solely from the symbolic name. For authentication incidents, correlate the exact time with DC shutdown/restart, Netlogon logs, service state, DNS/DC Locator results, and the client's selected controller. If only one DC returns the status, investigate that DC's lifecycle first; if all DCs return it, preserve the calling SAM/LSA operation because the status can arise from other SAM server state transitions.

What to inspect

  • Record the selected domain controller and rediscovery result for every retry.
  • Correlate the first failure with Netlogon and DC service shutdown timestamps.
  • Separate authentication credential failures from server-state rejection before changing passwords.

References

Looking for a different code? Search another status or error code.