diff --git a/src/pages/help/troubleshooting-client/windows.mdx b/src/pages/help/troubleshooting-client/windows.mdx index 5185322e..ea4e16ed 100644 --- a/src/pages/help/troubleshooting-client/windows.mdx +++ b/src/pages/help/troubleshooting-client/windows.mdx @@ -41,6 +41,7 @@ DNS on Windows has a few platform-specific failure modes worth checking separate - **Match-domain names don't resolve, even though the NRPT (Name Resolution Policy Table) rule was written.** A lingering Group Policy `DnsPolicyConfig` container can stop NetBird's rule from taking effect on an off-domain machine. See [DNS Troubleshooting: Issue 8 (lingering GPO)](/manage/dns/troubleshooting#issue-8-windows-nrpt-rule-is-written-but-never-takes-effect-lingering-gpo). - **Active Directory login, mapped drives, or DFS fail** while a file share by IP works. This is usually a DC-locator (`SRV` record) problem. See [Domain Controllers as routing peers](/manage/dns/internal-dns-servers#domain-controllers-as-routing-peers). +- **NetBird won't start on a Domain Controller** and the peer shows disconnected. The Windows DNS Server service can claim WireGuard's UDP port 51820 before NetBird does, so the tunnel never comes up. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers). For the full DNS diagnostic flow on any platform, see [DNS Troubleshooting](/manage/dns/troubleshooting). diff --git a/src/pages/manage/dns/troubleshooting.mdx b/src/pages/manage/dns/troubleshooting.mdx index bd6659b6..7b48200a 100644 --- a/src/pages/manage/dns/troubleshooting.mdx +++ b/src/pages/manage/dns/troubleshooting.mdx @@ -473,6 +473,10 @@ A domain resource only resolves `A`/`AAAA` records. Active Directory also depend - Add a **DNS nameserver** with match domain `corp.example.com` pointing at the DC's IP, distributed to your remote-users group — see [Active Directory & Windows File Shares → Give clients corp DNS](/use-cases/remote-access/active-directory#step-5-give-clients-corp-dns). - Confirm the DC itself is reachable through the routing peer on the AD ports — see [Reaching a Domain Controller through a routing peer](/manage/dns/internal-dns-servers#reaching-a-domain-controller-through-a-routing-peer). + +Running the NetBird client directly **on** a Domain Controller is a separate case: it can fail to start when the Windows DNS Server service has already claimed WireGuard's UDP port 51820. See [WireGuard port conflict on Domain Controllers](/manage/dns/internal-dns-servers#wire-guard-port-conflict-on-domain-controllers). + + --- ### Issue 8: Windows NRPT rule is written but never takes effect (lingering GPO)