Domain Controller / Domain-Joined Machine Misclassifies Network as Public at Startup Due to NLA Race Condition

Indicators

• Network connection shown as 'Public Network' at startup on a Domain Controller or domain-joined machine
• Windows Firewall applies Public Network profile rules instead of Domain profile rules after boot
• Disabling and re-enabling the NIC causes correct 'Domain Network' classification without reboot
• Issue is intermittent and consistently tied to the system startup sequence
• Netlogon or NLA-related errors present in System or Application Event Viewer logs at startup
• Event ID 4004 or 4010 in Microsoft-Windows-NetworkProfile/Operational log indicating network category changed to Public
• Event ID 5719 in System log (Netlogon) indicating machine could not authenticate to domain at network startup
• Applications or services relying on Domain/Private firewall rules fail immediately after boot or network reconnection

Likely causes

• No default gateway configured on the Domain Controller's network interface
• Default gateway configured but not responding to ICMP echo requests at startup time
• Race condition where Network Location Awareness (NLA) evaluates the network type before AD Domain Services is fully initialised
• Firewall or router ACLs blocking ICMP traffic between the DC and its default gateway
• NlaSvc service starts before dependent networking or AD DS services are ready during boot sequence
• DNS resolution for the domain unavailable at the time NLA performs its check, preventing domain identification
• Physical or virtual NIC initialises after NLA has already classified the network (NIC ordering issue, common in VMs)
• VPN client connects after NLA has already classified the network, so the domain network behind VPN is never re-evaluated
• Group Policy or registry misconfiguration explicitly sets or locks the network category
• NLA starts before DNS Client or LanmanWorkstation services are fully operational

Diagnostic steps

1. Verify a default gateway is configured on the NIC: run 'ipconfig /all' and confirm a Default Gateway entry is present on the relevant adapter.
   Confirms the basic network configuration prerequisite for NLA domain detection.
2. Test reachability of the default gateway: run 'ping <gateway_IP>' from the Domain Controller and confirm it receives ICMP echo replies.
   Determines whether ICMP-based gateway reachability check by NLA will succeed at boot.
3. Check the active Windows Firewall profile at startup: run 'netsh advfirewall show allprofiles' and confirm whether the Domain, Private, or Public profile is currently active.
   Establishes which firewall profile is in effect and whether the misclassification is confirmed.
4. Review the Network Location Awareness service (NlaSvc) startup dependencies in services.msc to ensure it is configured to start after required networking and AD DS services.
   Identifies service ordering issues that allow NLA to evaluate the network before dependencies are ready.
5. Check router and firewall ACLs to confirm ICMP traffic is permitted in both directions between the DC and its default gateway.
   Rules out ACL-level blocking as the reason NLA cannot confirm gateway reachability.
6. Review Event Viewer System and Application logs at startup timestamps for NLA, Netlogon, or NLASVC errors indicating why network classification failed.
   Provides timestamp-correlated evidence of the failure mode at boot.
7. Run 'Get-NetConnectionProfile' in PowerShell to confirm which profile is active and on which interface.
   Confirms profile is truly set to Public and identifies the affected network adapter by index.
8. Review the Microsoft-Windows-NetworkProfile/Operational event log for Event ID 4004/4010 around boot or reconnection time.
   Identifies when and why the profile changed to Public, and whether it was an NLA decision or a forced setting.
9. Check System log for Event ID 5719 (Netlogon) and Event ID 1129 (Group Policy) at boot time.
   Establishes whether domain connectivity was unavailable when NLA ran, confirming the race condition.
10. Run 'dsregcmd /status' to verify DomainJoined state, and 'nltest /dsgetdc:<domain>' to confirm a DC is currently reachable.
    Rules out actual domain connectivity loss vs. a startup timing issue.
11. Run 'sc qc NlaSvc' and 'Get-Service -Name NlaSvc, Dnscache, LanmanWorkstation | Select Name, Status, StartType' to inspect NLA service dependencies and startup order.
    Identifies whether NLA service dependencies are misconfigured or not running, which would prevent domain detection.

Resolution path

• Confirm a default gateway is configured on the Domain Controller's network interface using 'ipconfig /all'.
• Verify the default gateway device is online and responds to ICMP ping requests from the DC.
• If gateway ping is blocked by a firewall or ACL, update rules to permit ICMP echo replies from the gateway to the DC so NLA can classify the network correctly.
• If NLA consistently starts before AD DS is ready, create a startup script or scheduled task to restart the NlaSvc service after AD DS has fully initialised, or investigate Group Policy options to delay NLA evaluation.
• After applying fixes, reboot the Domain Controller and run 'netsh advfirewall show allprofiles' to confirm the Domain Network profile is active.
• Validate no unintended Public profile firewall rules remain in effect that could block domain traffic.
• Temporarily force the correct profile via PowerShell: 'Set-NetConnectionProfile -InterfaceIndex <index> -NetworkCategory Private' — for domain machines, the category should auto-resolve to DomainAuthenticated once NLA can reach a DC; forcing Private is an interim measure.
• Apply a persistent fix via Group Policy Network List Manager Policies: Computer Configuration > Windows Settings > Security Settings > Network List Manager Policies — select the relevant network, set Location type to 'Private' and User permissions to 'Not allowed'.
• Enable 'Always wait for the network at computer startup and logon' via Group Policy: Computer Configuration > Administrative Templates > System > Logon — set to Enabled, so NLA always has DC connectivity on first evaluation.
• For VPN environments where DC is reachable only through the tunnel: deploy pre-logon VPN (Always On VPN or equivalent) and ensure Split DNS routes DC queries through the tunnel so NLA can reach the DC immediately on connection.
• Restart the NlaSvc service to force re-evaluation without a full reboot: 'Restart-Service NlaSvc -Force'.

Prevention

• Always configure a default gateway on all Domain Controller network interfaces.
• Ensure the default gateway device responds to ICMP ping requests at all times, particularly during system startup.
• Do not configure firewall or ACL rules that block ICMP traffic between Domain Controllers and their default gateways.
• Use Group Policy (Computer Configuration > Windows Settings > Security Settings > Windows Firewall) to explicitly enforce the Domain firewall profile on domain-joined servers as a fallback.
• Monitor startup Event Logs for NLA and Netlogon errors as part of regular Domain Controller health checks.
• Document and validate network interface configuration (including default gateway) as part of any DC build or change management process.
• Enable 'Always wait for the network at computer startup and logon' via Group Policy (Computer Configuration > Administrative Templates > System > Logon) on all domain-joined machines.
• Use Network List Manager Policies in Group Policy to explicitly define the expected network category for known corporate networks, preventing NLA from defaulting to Public.
• Ensure DNS Client (Dnscache) and LanmanWorkstation services are listed as dependencies of NlaSvc and start before it — review service dependency chains if custom configurations have altered defaults.
• For VPN environments, deploy pre-logon VPN (Always On VPN or similar) so the domain network path is available before NLA performs its initial classification.

Tools

• ipconfig /all
• ping <gateway_IP>
• netsh advfirewall show allprofiles
• services.msc
• Event Viewer (eventvwr.msc)
• Get-NetConnectionProfile (PowerShell — view current network profile and category)
• Set-NetConnectionProfile (PowerShell — manually set network category)
• dsregcmd /status (verify domain join and Azure AD join state)
• nltest /dsgetdc:<domain> (confirm domain controller reachability)
• Event Viewer — Microsoft-Windows-NetworkProfile/Operational (profile change events, Event ID 4004/4010)
• sc qc NlaSvc (inspect NLA service configuration and dependencies)
• Restart-Service NlaSvc (force NLA re-evaluation without full reboot)
• Group Policy Management Console / gpedit.msc (Network List Manager Policies, Logon wait settings)

References

• ServerFault: Domain Controller thinks its on a Public Network