Windows Server / Active Directory & Group Policy
Investigate a server authenticating against the wrong AD site
Incorrect subnet-to-site mapping can send a server to distant controllers and increase authentication or policy latency.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
nltest /dsgetsiteRead the result
On the affected Windows member, the command reports its detected AD site or an error. It does not explain every locator cache or controller-selection decision.
Resolve and verify
Compare the server's actual network subnet with approved AD site mappings. Have the directory owner correct the mapping, then verify controller selection through the normal refresh process.
Before changing production
Do not manually pin applications to one controller as a permanent substitute for correct site design.