why do my servers keep defaulting to Private network from Domain, including the DC?

[TwistedHelixis]

I look after a few schools and since upgrading the servers (DC and DATA servers) at each school to server 2019, the network adapter defaults to Private. This is even on the domain controllers.

 

Resetting the 'Network location awareness' service does fix the issue.

 

The only difference I can think of betwwen this 2019 setup and my older 2012r2 setup, on my old DC servers in adapter settings > IPV4 > Properties > Advanced > DNS tab > 'DNS suffix for this connection' had our domain.lan, on our new servers I left this blank. I left this blank on the new servers as I read it wasn't needed.

Does everyone else have 'DNS suffix for this connection' filled in or is it blank?

If nobody else has this filled in then the issue probably lies elsewhere.

 

Is there a way of disabling the private and public connections, so it only has domain?

Is there a way of forcing it to always use Domain?

[Davit2005]

Should get a suffix from DHCP. Wondering if it is that **** NLA service again.

 

https://social.technet.microsoft.com/Forums/en-US/1a948231-a6ef-4bd1-9676-2b565d572762/domain-network-turns-to-public?forum=win10itpronetworking

 

Probably best not to try the first suggestion of disabling the connection unless you are able to access to the device console.

Edited April 27, 2023 by Davit2005

[TwistedHelixis]

Thanks for getting back to me

 

It can't be DHCP, as it also happens on the Domain controller.

 

On the page you linked it also mentions, Enter your domain name into the text box for "DNS suffix for this connection:". So I might do this, as it was there on the old server.

 

Would be really handy if someone else could quickly check if they have their domain added in, adapter settings > IPV4 > Properties > Advanced > DNS tab > 'DNS suffix for this connection'

[Davit2005]

I don't have access to a domain controller unfortunately to check. But I have seen the problem before but many years back. Don't get involved in Windows Domain Server stuff much these days. Edited April 27, 2023 by Davit2005

[TwistedHelixis]

Does anyone else have this on their DC, adapter settings > IPv4 > Properties > Advanced > DNS tab > 'DNS suffix for this connection'. Anything entered or is it blank?

[chaplic]

I’m guessing somehow the network stack isnt running right and cannot see the DC. I don’t think the suffix is the issue as a domain joined machine will apply that automatically.

 

 

Go into the Reg key shown and determine your network name then change profilename.local to that, run as admin/ system, perhaps set on boot via GP etc. Alternatively I’m sure you can work out a GPP to set, though I assume there was a reason I’ve put the logic in as below..

 

$o=gci "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" 

foreach ($r in $o) {$IP=Get-ItemProperty $r.PSPathif ($IP.ProfileName -eq "profilename.local")

{    
write-host "Change"    
 $ChangeOne= $("HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" + "\" + $IP.PSChildName)        
 New-ItemProperty -LiteralPath $changeOne -Name 'Category' -Value "1" -PropertyType Dword -Force -ea SilentlyContinue;    
 New-ItemProperty -LiteralPath $changeOne -Name 'CategoryType' -Value "0" -PropertyType Dword -Force -ea SilentlyContinue;
}

}

Edited April 29, 2023 by chaplic

[TwistedHelixis]

’m guessing somehow the network stack isnt running right and cannot see the DC.

 

Sorry I was not very clear in my previous posts, the issue I am having is on my DC. After a reboot it connects to the network and internet through the Private firewall, not the Domain firewall.

 

But if I restart the NLA service on the DC it then connects to the network and internet through the Domain firewall.

Edited April 30, 2023 by TwistedHelixis

[chaplic]

the NLA decides what network it is on, and determines domain network if it can see a DC. I can imagine the netlogon service starting after the NLA service but NLA service resolving via DNS that the best DC is itself. Maybe setting the NLA service to delayed start might be a punt, too?

[TwistedHelixis]

Lot of people with the same issue as me and also different ideas / solutions on this forum, so I will work through those.

 

https://community.spiceworks.com/topic/2205082-new-server-2019-dc-keeps-setting-network-location-to-private-why

[TwistedHelixis]

Creating a scheduled task script that stops and starts the NLA service a few minutes after a reboot seems to be the simplest fix.

[Koldov]

@TwistedHelixis

 

Did you ever find a better solution?

 

I did the Windows Updates for all our servers last night and it quickly reminded me that I should have sorted this out!!!

 

My problem is similar to yours (all server 2019, DCs, VMs and Hosts, etc.) however all mine default to 'Public'...

 

Luckily I have a VPN solution and I worked out that for the hosts I can log into the Network Switch they are on and can disable/enable the ports which seems to bring them back on Domain.

 

Unfortunately this doesn't seem to work for the VMs... last night I just pinged them all and as they replied I thought that was the job done... this morning when I got to work I tried to RDP and couldn't connect... that's when I knew.

 

All I do is go in through Hyper-V Manager, disable/enable the NIC on each VM and they pick up the Domain instantly, why can't they do that on reboot?!

 

I guess it isn't a massive problem otherwise there would have been a fix by now (and a lot more gnashing of teeth/crying/wailing on t'internet), I wonder if it's more to do with our server/network set-up or something....?

 

Anyway, if nobody has found a permanent fix, could you please share the settings for your task?

[andy_b]

Scheduled task to restart NLA is probably the easiest solution.

 

You can make the NLA service dependent on NetLogon (I think?) and that mostly works.

[Koldov]

Thanks, not sure of the exact settings to make that happen, at 'start-up' but delayed enough to make sure the OS is up and running and NICs are initialised for it to have the desired affect (also to rely on NETLOGON wouldn't the DC have to be up? The DCs are some of the VMs that are having the issue)?

 

Anyway, I have attempted the following, by putting a GPO/GPP to drop a Scheduled Task onto all the servers:

 

 

 

 

Action: Start a program

 

Program/script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

 

Add arguments (optional): -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Restart-Service -Name NlaSvc -Force"

 

NB: These were from an older thread, here (hope it's still relevant):

 

https://www.edugeek.net/forums/windows-server-2016/198509-powershell-service-restart.html

[mrbios]

I had this issue but only when both DCs were restarting at the same time for windows updates each month. Splitting them into updating on a separate rota so that one was always up resolved it, do my updates via SCCM so i just put each DC in to a separate collection with a separate update deployment.....as i couldn't get orchestration groups to work lol. Not sure if the detail of DNS mattered as much, but they use each other for DNS primary and local secondary.

[Koldov]

That might be a 'thing' actually, pretty much the same as you they only get restarted at update time. Although there's usually a few minutes inbetween as the DC VM is shutdown on each host and all the VMs get shutdown and only then is the host restarted but I do them one host at a time and make sure one is 'up' before I do the other.

 

I've put in the mitigations for the NLA restart now though so don't feel like removing to test, but good to have another input on the thread if others come searching.