Windows Server: Error When Testing the Secure Channel of the PDC Emulator: "Domain does not Exist or Could not be Contacted"
Summary: Testing the secure channel on an Active Directory (AD) domain controller (DC) which holds the PDC Emulator role results in an error. This error indicates that the domain either does not exist or could not be contacted. This does not indicate a problem with the secure channel. ...
Symptoms
The Test-ComputerSecureChannel PowerShell command returns the error "The specified domain either does not exist or could not be contacted" when run on the PDC Emulator.
Other commands for testing the secure channel, such as nltest /sc_query, nltest /sc_verify, and netdom verify, also return similar errors on the PDC Emulator.
Cause
The cause is not known. This behavior is consistent, but the underlying issue does not appear to be documented anywhere.
Resolution
These errors are expected when these commands are run on the PDC Emulator. They alone do not indicate a problem with the secure channel.
If a broken secure channel is suspected, other means must be used to confirm this. In general, if AD replication is functional between DCs and the various AD consoles do not return errors, the secure channel is intact. Several errors commonly indicate a broken secure channel:
- The target principal name is incorrect.
- The target account name is incorrect.
- The trust relationship between this workstation and the primary domain failed.
- The security database on the server does not have a computer account for this workstation trust relationship.
Repairing a broken secure channel is outside the scope of this article.