Can I force a workstation to use a specific domain controller?

Question

I'm on a domain that I can't control the domain controllers on, but I can control my systems. All the domain controllers are part of one site, and that cannot change.

However, one of the domain controllers is not working correctly and the admins in charge of it are taking forever to resolve the issue. There are 6 total domain controllers... for some reason my workstations/servers are still attempting to use the bad one to authenticate my users.

Is there a way to force a workstation to use specific domain controllers? or, better yet, force it to NOT use the bad one?

Thanks in advance!

Solution 1

I've never done it, but supposedly you could use the #PRE tag in the lmhosts file on each workstation to set the preferred domain controller back in NT 4.0 days. Not sure if it still works, but it's worth a try. You can read about it at Microsoft Technet here under the "Specifying Domain Controllers" section. Make sure to reboot after lmhost changes.

Take a look at that entire document. That has more about lmhosts files in it than I ever wanted to know.

Solution 2

I've had this problem on WinXP machines before. Not finding a more elegant solution and being in a hurry I searched the registry for the name of the defective domain controller and replaced it with the name of the good one, followed by a reboot. I'd be more specific about the keys involved if I could but that was years ago.

Solution 3

I've struggled finding a solution to this problem for years. Neither registry changes or LMHOSTS modifications have been reliable - finally I think I've found a solution that works, however, it is risky at best so use at your discretion.

Simply manipulating the HOSTS file (%WINDIR%\System32\Drivers\etc\hosts) to forcibly point all other domain controllers to the domain controller of choice, when the NIC is initializing (presumably as TCP/IP is loaded up) will point your client machine at a different DC.

For example: If my PC keeps pointing at DC1-SITE1 (you can check by running nltest /dsgetdc:DOMAIN ), and I want to point at DC16-SITE3, I first find out all the domain controllers in my Site/Domain by running:

nltest /dclist:DOMAIN

Then, I simply point all the other domain controllers at the one I want in the HOSTS file. If my DC16-SITE3 IP is 10.1.1.1, then this would look like this:

10.1.1.1 DC1-SITE1
10.1.1.1 DC1-SITE2
10.1.1.1 DC2-SITE2
10.1.1.1 DC3-SITE10
...

and so forth.

Then, go into your network connections (Start -> Run -> ncpa.cpl), Right-click & "Disable" the NIC, then re-enable it. Re-run nltest /dsgetdc:DOMAIN and voila. If you get a different domain controller connection, check to make sure it was repointed in HOSTS.

Since this would probably cause side-effects, I've only used to temporarily test if problematic behavior is consistent across different domain controllers - then I revert the HOSTS file back to normal as soon as possible.

Comments

[Wesley]

Living on the edge, man. I approach the registry like it was a starved panther with astigmatism that makes me look like a tender chuck roast. Do you juggle flaming chainsaws in your spare time? =)

[Chad]

I do see the offending domain controller listed several times in my server's registry... ugh. I'll try to switch them. Thanks.

[Coruscate5]

FWIW - this didn't work for me, & I triple-checked my Lmhosts config - might have to do with my Domain config though (Functional level is 2008 R2)