Find Domain Controllers in Windows Registry
This article outlines the exact Windows Registry paths where the
operating system stores details about known domain controllers, active
domain connections, and trusted network domains. While the DC Locator
service resolves domain controllers dynamically using DNS SRV records,
persistent settings, active bindings, and discovery cache are maintained
within specific subkeys under HKEY_LOCAL_MACHINE.
1. Netlogon Parameters and Site Information
The primary registry location managing communication and discovery of domain controllers is the Netlogon service registry path:
- Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Key values stored here include: *
DynamicSiteName: The Active Directory site
the machine currently belongs to based on IP subnet mapping. *
SiteName: The statically configured site
name (if manually set). *
TrustedDomainList: A list of trusted
network domains discovered by the system.
2. Active Group Policy Domain Controller
Windows records the specific domain controller used for downloading and applying Group Policy objects in the Group Policy history key:
- Path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
Key values stored here include: *
DCName: The fully qualified domain name
(FQDN) or NetBIOS name of the domain controller that last provided Group
Policy updates.
3. Local Security Authority (LSA) Domain Cache
Authentication targets, domain sids, and local domain cache are tracked under the Local Security Authority:
- Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Within this key, subkeys such as Kerberos\Domains and
Lsa\JD track domain names, realm mappings, and domain
security identifiers associated with reachable domain controllers.
4. Temporary and Dynamic Discovery Cache
Windows primarily relies on in-memory caching via the DC Locator
process (executed by Netlogon.dll and
DsGetDcName) rather than keeping a single static list of
all network domain controllers in the registry.
To view the active dynamic domain controller cache resolved via DNS and RPC pings in real-time, use the command-line tool:
nltest /dsgetdc:yourdomain.comTo view all discovered domain controllers across trusted domains cached in memory:
nltest /domain_trusts