Event ID 5781: Dynamic registration or deletion of one or more DNS records associated with DNS
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
Dynamic registration or deletion of one or more DNS records associated with DNS
Event 5781
NETLOGON
System log
Message and fields (as Event Viewer shows them)
Dynamic registration or deletion of one or more DNS records associated with DNS
domain '…' failed. These records are used by other computers to locate this
server as a domain controller (if the specified domain is an Active Directory
domain) or as an LDAP server (if the specified domain is an application partition).
Possible causes of failure include:
- TCP/IP properties of the network connections of this computer contain wrong IP address(es) of the preferred and alternate DNS servers
- Specified preferred and alternate DNS servers are not running
- DNS server(s) primary for the records to be registered is not running
- Preferred or alternate DNS servers are configured with wrong root hints
- Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration
USER ACTION
Fix possible misconfiguration(s) specified above and initiate registration or deletion of
the DNS records by running 'nltest.exe /dsregdns' from the command prompt on the domain
controller or by restarting Net Logon service on the domain controller.