Skip to content
Browse

/errors/active-directory/unable-to-find-a-default-server-with-active-directory-web-services-running

Unable to find a default server with Active Directory Web Services running.

The commands on this page have not been executed by our verification runner yet.updated
tool
Active Directory PowerShell
exit code
1
versions
ActiveDirectory module (RSAT) on Windows 10/11 and Windows Server 2016+
os
windows

Unable to find a default server with Active Directory Web Services running. means the ActiveDirectory PowerShell module (Get-ADUser, Get-ADComputer …) could not find a domain controller to talk to. The module does not use LDAP directly: it talks to Active Directory Web Services (ADWS) on a domain controller, on TCP port 9389. Without -Server, it asks the DC locator for a DC of the computer's domain. The usual causes are a computer that is not in the domain (or off the VPN), DNS that does not point at the domain's DNS servers, or a firewall blocking 9389.

Quick test: name a server

powershell
Get-ADUser -Identity jdoe -Server dc01.contoso.com
Get-ADDomain -Server contoso.com -Credential (Get-Credential)   # from a machine outside the domain

If this works, the problem is locating a DC (domain membership or DNS), not ADWS itself.

Find where it breaks

powershell
nltest /dsgetdc:contoso.com                          # does the DC locator find a DC?
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.contoso.com
Test-NetConnection dc01.contoso.com -Port 9389       # is ADWS reachable?
(Get-CimInstance Win32_ComputerSystem).PartOfDomain  # is this machine domain-joined?

On the domain controller:

powershell
Get-Service ADWS
Get-WinEvent -LogName 'Active Directory Web Services' -MaxEvents 20
ResultMeaningFix
nltest failsno DC found through DNSset the client DNS to the domain DNS servers, connect the VPN
nltest works, port 9389 closedfirewall or ADWS stoppedopen TCP 9389 between client and DCs, start ADWS
PartOfDomain is Falseworkgroup or Entra-joined deviceuse -Server and -Credential on every cmdlet
Works with -Server onlydefault DC selection failsset $PSDefaultParameterValues for -Server, or fix site and DNS configuration

To avoid typing -Server on every command in a session:

powershell
$PSDefaultParameterValues['*-AD*:Server'] = 'dc01.contoso.com'

Sources

Related pages

flags · active-directoryGet-ADUser -Filter syntax: examples with -like, variables, dates and -PropertiesGet-ADUser -Filter takes a query string such as "Name -like 'Ann*'". Quote the values, add -Properties for extra attributes and use -SearchBase for one OU.commands · active-directoryInstall RSAT on Windows 11 to get the ActiveDirectory PowerShell moduleOn Windows 11, RSAT is an optional feature: add RSAT Active Directory Domain Services Tools in Settings or run Add-WindowsCapability -Online as admin.errors · powershellThe specified module 'x' was not loaded because no valid module file was found in any module directory.Import-Module found no module by that name in any PSModulePath folder: it is not installed, was installed for the other PowerShell edition, or is misspelled.