Fix 0X00000995: Domain controller not found for this domain

Before you start: What 0X00000995 means

This error shows up when a Windows machine tries to join or find a domain controller for the domain you specified, but can't talk to one. I've seen it most often after someone changes the network adapter's DNS settings, or when a VPN disconnects and the machine still thinks it's on the corporate network. The machine sends out a DNS query for the domain's SRV records — _ldap._tcp.dc._msdcs.yourdomain.com — and gets nothing back. That's your clue.

30-second fix: Flush DNS and renew IP

This is almost always the first step. Don't skip it. Open Command Prompt as Administrator (right-click Start, choose 'Command Prompt (Admin)' or 'Windows Terminal (Admin)'). Run these four commands:

ipconfig /flushdns
ipconfig /registerdns
ipconfig /renew
nbtstat -R

What you should see: After ipconfig /flushdns you'll see 'Successfully flushed the DNS Resolver Cache'. After ipconfig /registerdns — no error. After ipconfig /renew — it might pause while it gets a new IP (if DHCP). After nbtstat -R — 'Successful purge and preload of the NBT Remote Cache Name Table'.

Now try joining the domain again. If the error goes away, you're done. If not, move to the next step.

5-minute fix: Check your DNS server addresses

The machine must use a DNS server that hosts the domain's zone. That's usually the domain controller itself, or a DNS server that forwards to it. If you're on a work laptop at home, this is where the fix lives.

1. Open Network Connections: Press Win + R, type ncpa.cpl, hit Enter.
2. Right-click your active network adapter (usually Ethernet or Wi-Fi), choose 'Properties'.
3. Find 'Internet Protocol Version 4 (TCP/IPv4)' in the list, double-click it.
4. Check the DNS settings. Forcing the correct DNS server is the real fix here. If you get a DHCP-assigned DNS, but that DNS server doesn't know your domain, you'll get 0X00000995.
5. Set 'Use the following DNS server addresses' and enter the IP of your domain controller. For example: 192.168.1.10. If you have a secondary, add it. Otherwise use 8.8.8.8 — but know that Google's DNS won't help you find a corporate domain.
6. Click OK, close all dialogs.

Now test: Open Command Prompt and run nltest /dsgetdc:yourdomain.com. Replace yourdomain.com with your actual domain. If it returns the name of a domain controller, you're good. If it still fails, let's dig deeper.

15-minute fix: Verify domain controller SRV records and connectivity

This step assumes you know your domain controller's IP address. Get it from your network admin if you don't have it.

Step 1: Ping the domain controller

Open Command Prompt and ping the IP: ping 192.168.1.10. If you get replies, skip ahead. If you get 'Destination host unreachable' or 'Request timed out', you have a network issue — check your firewall, VLAN, or VPN connection.

Step 2: Check SRV records in DNS

Run this command, replacing yourdomain.com:

nslookup -type=srv _ldap._tcp.dc._msdcs.yourdomain.com

What you should see: A response showing a server name and IP address. If you see 'server failed' or 'non-existent domain', DNS is broken. That means either the DNS server doesn't have the zone, or the zone is missing the SRV records.

If you're on the same network as the domain controller but still get 'non-existent domain', the domain controller's DNS service might be missing the _msdcs zone. You can fix that on the DC by opening DNS Manager, right-clicking the zone, and choosing 'New Delegation' — but that's a separate guide. For now, try this workaround:

Step 3: Add a manual Hosts file entry (emergency fix)

This bypasses DNS entirely. Open Notepad as Administrator. Open the file C:\Windows\System32\drivers\etc\hosts. Add a line like this at the bottom:

192.168.1.10   DC1.yourdomain.com

Replace with your actual DC IP and name. Save the file. Then run ipconfig /flushdns again. Try joining the domain now. This is a band-aid — you should fix DNS properly later, but it'll get you back online.

Step 4: Verify the machine's time is synced

Kerberos authentication needs time to be within 5 minutes of the DC. Right-click the clock, choose 'Adjust date/time', turn on 'Set time automatically', and if it's still wrong, click 'Sync now'. Then try again.

If nothing works: Next steps

You might have a trust issue. If this machine was previously joined to another domain, or the domain controller was rebuilt without rejoining, you'll need to unjoin the domain first: go to System Properties (right-click This PC > Properties > Advanced system settings), click 'Change' under Computer Name, select 'Workgroup', give it a random name, reboot, then rejoin the domain. This is a nuclear option — but I've seen it work when nothing else did.

The exact error 0X00000995 is almost always DNS or network. Check those two things first, and you'll save yourself an hour of frustration.