| Previous | Next |
| STATUS_CANT_TERMINATE_SELF | STATUS_INVALID_DOMAIN_STATE |
STATUS_INVALID_SERVER_STATE
A domain controller shutdown path is a documented producer of this state
STATUS_INVALID_SERVER_STATE is more specific than a generic server failure. Microsoft documents a domain-controller shutdown scenario in which a DC normally returns this status to current Netlogon clients so that they stop using the shutting-down controller and locate another one. That makes the server lifecycle state and the client's DC-selection cache central evidence.
The documented failure mode is subtle: a controller can already be shutting down while still answering new Netlogon UDP queries. A client can then select it again, receive the state failure, and repeat the selection cycle. DC Locator and DsGetDcName maintain discovery and cached-controller behavior, so a trace should distinguish the DC that was selected, the DC that rejected the operation, and whether rediscovery actually selected a different controller.
Do not diagnose this status as a bad password or damaged account database solely from the symbolic name. For authentication incidents, correlate the exact time with DC shutdown/restart, Netlogon logs, service state, DNS/DC Locator results, and the client's selected controller. If only one DC returns the status, investigate that DC's lifecycle first; if all DCs return it, preserve the calling SAM/LSA operation because the status can arise from other SAM server state transitions.
What to inspect
- Record the selected domain controller and rediscovery result for every retry.
- Correlate the first failure with Netlogon and DC service shutdown timestamps.
- Separate authentication credential failures from server-state rejection before changing passwords.
References
- Microsoft: DC shutdown authentication failure
- Microsoft: DC Locator
- Microsoft: DsGetDcName
- Microsoft: Windows authentication credential processes
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.