Fix STATUS_DIRECTORY_SERVICE_REQUIRED (0XC00002B1) error

What's happening here?

You're trying to join a domain, map a network drive, or log in with domain credentials — and you get this ugly error. The system is telling you it needs a directory service (like Active Directory), but it can't find one. I know this error is infuriating because everything looks fine, but nothing works.

I've seen this on Windows 10 workstations trying to join a Windows Server 2019 domain, and on Windows Server 2022 boxes that lost connectivity to the domain controller. Usually the culprit is DNS or network routing. Let's fix it.

Fix 1: Check DNS (30 seconds)

Most of the time, this error happens because your PC can't find the domain controller. And the most common reason? Wrong DNS.

On your client machine, open a command prompt (run as admin) and type:

nslookup yourdomain.com

Replace yourdomain.com with your actual domain name (like contoso.com). If you get a response that returns an IP address — good sign. If you get Non-existent domain or a timeout — you found the problem.

If DNS is broken, change your network adapter's DNS to point to the domain controller's IP. On Windows 10/11:

1. Open Network & Internet settings.
2. Click Change adapter options.
3. Right-click your active network adapter, choose Properties.
4. Double-click Internet Protocol Version 4 (TCP/IPv4).
5. Select Use the following DNS server addresses.
6. Set Preferred DNS server to the domain controller's IP (like 192.168.1.10).
7. Click OK, then close everything.

Run ipconfig /flushdns in admin command prompt, then try your domain operation again.

If this didn't fix it, move to Fix 2.

Fix 2: Test domain controller connectivity (5 minutes)

Sometimes DNS works but the domain controller itself is unreachable. Maybe a firewall is blocking ports, or the DC is down.

First, ping the domain controller by IP:

ping 192.168.1.10

Replace with your DC's IP. If it doesn't reply, check network cables, switch ports, or firewall rules. The DC needs to allow ICMP (ping) for diagnostics.

Next, test the critical ports. The domain controller needs these ports open for domain join and authentication:

• TCP 389 (LDAP)
• TCP 636 (LDAPS)
• TCP 445 (SMB)
• TCP 135 (RPC)
• UDP 389 (LDAP)
• UDP 53 (DNS)

Run this command to test LDAP:

telnet 192.168.1.10 389

If the screen goes blank (no error), the port is open. If you get a failure message, the port is blocked. That's your problem.

Also check that the DC itself is running the Active Directory Domain Services service. On the DC, open Services.msc and look for Active Directory Domain Services. It should be running. If it's stopped, start it and set it to Automatic.

If you can ping the DC and the ports are open, move to Fix 3.

Fix 3: Rebuild the secure channel or rejoin the domain (15+ minutes)

If DNS and connectivity are fine, the secure channel between your client and the domain is probably broken. This happens after a password reset on the computer account, or if the client was offline for too long.

First, try to reset the machine account password. On the client, run as admin:

nltest /sc_reset:yourdomain.com\yourdc

Replace yourdomain.com with your domain and yourdc with the DC's name. If this succeeds, reboot and test.

If that fails, remove and rejoin the domain. This is the nuclear option, but it works.

1. Right-click Start, choose System.
2. Click Rename this PC (Advanced).
3. Under Computer Name/Domain Changes, click Change.
4. Select Workgroup, type WORKGROUP, click OK.
5. Reboot.
6. After reboot, go back to the same screen.
7. Select Domain, type your domain name, and provide admin credentials when prompted.
8. Reboot again.

This forces the client to create a fresh secure channel with the DC. I've used this trick countless times when the error wouldn't go away.

One more thing — check time sync

Kerberos won't work if the client's clock is more than 5 minutes off from the DC. On the client, run:

w32tm /resync

If you get an error, set the DC as the time source:

w32tm /config /manualpeerlist:yourdcip /syncfromflags:manual /update
net stop w32time && net start w32time
w32tm /resync

Replace yourdcip with the DC's IP. This fixes a surprising number of 0xC00002B1 errors.

Still stuck?

If none of these steps work, you might be dealing with a corrupt domain controller or a firewall that's too strict. Check Event Viewer on the client under Applications and Services Logs > Microsoft > Windows > Directory-Service for more clues. Or try a different network (like a wired connection instead of Wi-Fi) to rule out local network issues.

Good luck — you'll beat this error.