How to Use the nltest Command in Windows 11 to Test Domain Controller Trust and Secure Channels

When troubleshooting enterprise authentication failures, Group Policy application delays, or single sign-on anomalies on domain-joined Windows 11 devices, administrators require rapid insight into Netlogon communications. The native command-line utility nltest queries the Netlogon service directly, verifying Active Directory trust relationships, querying domain controller discovery routines, and testing secure channel integrity without requiring bulky administrative consoles.

Core Diagnostic Switches

The nltest executable is bundled natively in Windows 11 system directories. Common administrative operations utilise the following parameter combinations:

Step-by-Step Diagnostic Procedures

1. Open an Elevated Command Prompt: Press Win + X and choose Terminal (Admin). Ensure the session runs with administrative privileges.
2. Querying the Domain Controller Locator: Discover which DC your workstation communicates with and verify that the local client subnet matches the assigned Active Directory site:

   nltest /dsgetdc:example.com /kdc

   Inspect the returned fields: DC Name, Our Site Name, and Client Site Name. If Client Site Name differs from Our Site Name, the client is traversing network boundaries to reach a non-optimal site, signalling a misconfigured subnet definition in Active Directory Sites and Services.
3. Validating Machine Account Trust: Test whether the cryptographic secure channel between Windows 11 and Active Directory remains intact:

   nltest /sc_query:example.com

   A healthy response returns:

   Flags: 30 HAS_IP  HAS_TIMESERV
   Trusted DC Name \DC01.example.com
   Trusted DC Connection Status Status = 0 0x0 NERR_Success
   The command completed successfully

   Any return code other than NERR_Success indicates an expired machine password or trust break.
4. Resetting and Re-establishing Broken Trust: If the secure channel displays authentication failures, execute an immediate reset against a specific responsive DC:

   nltest /sc_reset:example.com\DC02.example.com

   This forces Netlogon to regenerate session keys and re-authenticate without requiring unjoining and rejoining the domain.

Querying Forest Trust Relationships

To inspect multi-domain enterprise environments and verify external or cross-forest trusts, run:

nltest /domain_trusts /all_trusts

This command outputs the complete trust hierarchy, identifying whether trusts are transitive, inbound, outbound, or bidirectional. It provides administrators with immediate clarity when investigating cross-forest permission denials.