Netlogon Service in Windows 2000 DC Discovery

In Microsoft Windows 2000, the Netlogon service plays a central role in locating domain controllers by bridging Active Directory with the Domain Name System (DNS). Unlike previous Windows NT environments that relied primarily on NetBIOS broadcasts and WINS, Windows 2000 relies on the Netlogon service to publish domain controller availability in DNS, process client discovery requests through the DC Locator mechanism, and direct clients to the closest domain controller within an Active Directory site.

Dynamic DNS Record Registration

On the server side, the Netlogon service on every Windows 2000 domain controller (DC) is responsible for advertising the services the machine provides. When the domain controller boots up or the Netlogon service restarts, it automatically registers a collection of DNS resource records via Dynamic DNS (RFC 2136):

  • Service (SRV) Records: Netlogon registers SRV records that map specific services (such as LDAP and Kerberos) to the DC's host name and port. These include generic records (_ldap._tcp.dc._msdcs.<DomainName>) and site-specific records (_ldap._tcp.<SiteName>._sites.dc._msdcs.<DomainName>).
  • Host (A) Records: It registers standard A records mapping the DC's fully qualified domain name (FQDN) to its IP address.
  • Log File Creation: Netlogon records all registered entries locally in %SystemRoot%\System32\Config\Netlogon.dns. If dynamic DNS updates fail, administrators can use this file to populate DNS manually.

The Client-Side DC Locator Process

When a client computer joins a domain, authenticates a user, or requests a domain service, it invokes the DsGetDcName API. This API relies on the client's local Netlogon service to run the Domain Controller Locator algorithm:

  1. DNS Query: The client's Netlogon service queries the configured DNS server for SRV records associated with the target domain. If the client already knows its Active Directory site, it queries for site-specific SRV records first. If the site is unknown, it queries for generic domain-wide SRV records.
  2. LDAP Ping (cLDAP): DNS returns a prioritized list of candidate domain controllers. The client Netlogon service sends a connectionless LDAP (cLDAP) search request over UDP port 389 to one or more candidate DCs.
  3. Site Verification: The candidate DC checks its Active Directory subnet definitions against the client's IP address. The DC responds over UDP with details including the domain name, forest name, DC name, and the client's actual site membership.
  4. Optimal DC Selection: If the responding DC is not in the client’s designated site, the client uses the returned site information to initiate a new DNS query for that specific site. This ensures the client connects to the closest available DC to minimize WAN traffic.
  5. Caching: Once an optimal DC is found, the Netlogon service caches the DC's information in memory and in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters) to speed up future discovery attempts.

Fallback and Redundancy

If DNS is unavailable or the domain is configured in mixed mode with legacy Windows NT 4.0 systems, the Netlogon service can fall back to NetBIOS-based discovery using mailslot broadcasts or WINS queries. However, for native Windows 2000 domain discovery, Netlogon operates primarily through standard DNS SRV lookups and UDP-based LDAP queries, providing an efficient, site-aware discovery mechanism.