What does Windows error code 1311 (ERROR_NO_LOGON_SERVERS) mean?

 
Previous Next
ERROR_CANT_DISABLE_MANDATORY ERROR_NO_SUCH_LOGON_SESSION

ERROR_NO_LOGON_SERVERS

No domain logon server is available for the request.

ERROR_NO_LOGON_SERVERS is Win32 error 1311 (0x51F). The computer cannot contact a domain controller capable of servicing the authentication request. Users may still be able to sign in with cached credentials, but operations requiring live domain validation can fail.

Primary fault domains

  • the client uses DNS servers that cannot locate Active Directory records
  • network, VPN, firewall, routing, or site connectivity blocks domain controllers
  • Netlogon, KDC, DNS, or directory services are unavailable
  • the machine secure channel is broken or its password copies disagree
  • time, domain membership, cloning, or restored snapshots created inconsistent state

Evidence to collect

Record the client name, domain, user logon form, network interfaces, DNS server list, selected site, attempted domain controllers, time offset, and whether cached sign-in works. Export System, Netlogon, Group Policy, Kerberos, DNS Client, and authentication events. Include the exact operation because interactive logon, service startup, SMB access, and credential validation can follow different paths.

Diagnostic sequence

Verify network reachability and that the client queries domain DNS rather than public resolvers. Resolve the domain-controller locator records and use supported tools such as nltest, dcdiag, and secure-channel tests to identify the failing layer. Check time synchronization and whether the contacted controller is healthy for the client’s site.

If DNS discovery succeeds but authentication still fails, examine the computer account and secure channel. A snapshot restore or long-disconnected clone can leave the local machine password inconsistent with Active Directory. Do not repeatedly remove and rejoin the domain before collecting evidence; that action changes the state needed to diagnose the original fault.

Recovery

Restore domain DNS and network access, repair the secure channel with supported administration commands, or recover the affected domain controller service. For remote users, ensure the VPN establishes before operations that require uncached credentials. Retry after DC discovery and secure-channel validation both succeed.

Difference from bad credentials

ERROR_LOGON_FAILURE normally indicates that supplied credentials were rejected. Error 1311 means a suitable domain logon server was unavailable, so changing the password may not help and can complicate cached-sign-in behavior.

Example

A laptop connects to a VPN but retains a public DNS server from the local network. Internet access works, while domain controller SRV lookups fail and file access returns 1311. Applying the corporate DNS configuration through the VPN restores DC discovery and authentication.

References

Looking for a different code? Search another status or error code.