Force a Specific Domain Controller via Regedit

By default, Windows uses dynamic DNS queries and Active Directory site topology to locate and authenticate against an available Domain Controller (DC). In certain network troubleshooting, testing, or maintenance scenarios, you may need to bypass this dynamic discovery process. This guide explains how to use the Windows Registry Editor (regedit) to force a client machine to target a specific Domain Controller for Kerberos authentication and how to trigger an immediate re-authentication.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

Step 2: Navigate to the Kerberos Domain Configuration

To specify a Domain Controller explicitly, you must define the Key Distribution Center (KDC) for your domain in the Kerberos registry key:

  1. In the Registry Editor, navigate to the following path:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains

  2. If the Domains key does not exist under Kerberos, right-click on Kerberos, select New > Key, and name it Domains.

  3. Under the Domains key, check if a subkey named after your fully qualified domain name (FQDN) exists (for example, CORP.EXAMPLE.COM).

    • If it does not exist, right-click Domains, select New > Key, and name it with your domain’s FQDN in uppercase.

Step 3: Define the Target Domain Controller

  1. Select the key corresponding to your domain name (e.g., CORP.EXAMPLE.COM).
  2. Right-click in the empty space on the right-hand pane and select New > Multi-String Value (REG_MULTI_SZ).
  3. Name this value KdcNames.
  4. Double-click KdcNames to edit its value.
  5. In the Value data field, enter the fully qualified domain name (FQDN) or the IP address of the specific Domain Controller you want to use.
  6. Click OK to save the value.

Step 4: Force Re-Authentication

Modifying the registry configures where requests are directed, but active sessions and cached tickets must be refreshed to establish a new connection to the specified DC:

  1. Open Command Prompt as an Administrator.

  2. Purge existing Kerberos tickets by running:

    klist purge

  3. Restart the Netlogon service to force secure channel renegotiation:

    net stop netlogon && net start netlogon

  4. Lock and unlock the workstation (Windows Key + L), or sign out and sign back in to complete authentication against the specified Domain Controller.

Step 5: Verify the Active Domain Controller

To confirm that the machine has authenticated against the designated Domain Controller:

  1. Open Command Prompt.

  2. Run the following command to display the current logon server:

    echo %LOGONSERVER%

  3. Alternatively, check the domain discovery status using nltest:

    nltest /dsgetdc:yourdomain.com