Azure Local deployment fails at "Validate Active Directory Configuration" (TestClusterAD): some nodes cannot reach a writable DC

Question

Azure Local deployment fails at "Validate Active Directory Configuration" (TestClusterAD): some nodes cannot reach a writable DC

Mishra, Keshav Kumar (PSD-GCC) 80

Environment

Azure Local, 4 nodes, ARM Deployment(Custom storage IPs)

Problem

Deployment fails at step "Create the cluster" (0.16.4 - TestClusterAD) with:

"Cluster Validation failed in following tests: Validate Active Directory Configuration - Fail"

The generated cluster validation report says:

"Connectivity to a writable domain controller from node <Node1> could not be determined because of this error: Could not get domain controller name from machine <Node1>" (same for <Node3>)
"Node(s) <Node2> <Node4> can reach a writable domain controller"
Site Name is blank for all four nodes
All four nodes show the same domain, domain role (Member Server) and OU
Informational only: missing SPN MSServerClusterMgmtAPI on one node, and the OU does not deny "Delete All Child Objects"

In an earlier run, the same test failed for a different node (<Node4>), retrying worked during validation, but getting this again during deployment.

Manasa Akula 775 Reputation points Microsoft External Staff Moderator

2026-10-12T19:12:37.8333333+00:00
Hello Mishra, Keshav Kumar (PSD-GCC,

Thank you for sharing the cluster validation report.

The deployment is failing at Validate Active Directory Configuration (TestClusterAD) because Domain Controller discovery is inconsistent across the Azure Local nodes. Node1 and Node3 cannot locate a writable domain controller, while Node2 and Node4 can. The blank site name also suggests that the node management subnet may not be mapped to the correct Active Directory site. The SPN and OU messages appear informational and are not the immediate cause of this failure.

Please perform the following checks on all four nodes from an elevated PowerShell or Command Prompt:

ipconfig /all Get-DnsClientServerAddress nltest /dsgetdc:<domain-FQDN> /force nltest /dsgetsite nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain-FQDN>

Please verify that:

All nodes use the correct AD-integrated DNS servers.

Every node consistently discovers a writable domain controller.

The LDAP SRV records resolve successfully.

nltest /dsgetsite returns the correct AD site.

The management subnet is mapped to the correct site in Active Directory Sites and Services.

DNS, Kerberos, LDAP, SMB, RPC, and dynamic RPC traffic is allowed between every node and the writable domain controllers.

Please also validate the secure channel and DC health:

Test-ComputerSecureChannel -Verbose w32tm /query /status

On the writable domain controller:

dcdiag /test:dns /v repadmin /replsummary

After correcting any DNS, site-mapping, firewall, replication, or secure-channel issues, confirm that all four nodes consistently return a writable DC and valid site name. Then rerun Azure Local validation and retry the deployment.

Microsoft documentation:

Prepare Active Directory for Azure Local deployment

Custom Active Directory configuration for Azure Local

Configure firewall for Active Directory domains and trusts

Cluster validation test on Active Directory configuration fails

If the validation still fails, please share the outputs of the DC discovery, site, SRV lookup, dcdiag, and repadmin commands.

Thank you for your cooperation.

Azure Local deployment fails at "Validate Active Directory Configuration" (TestClusterAD): some nodes cannot reach a writable DC

Your answer