<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="Netlogon">Net Logon</string>
<string id="Netlogon_AllowSingleLabelDnsDomain">Location of the DCs hosting a domain with single label DNS name</string>
<string id="Netlogon_AllowSingleLabelDnsDomain_Help">Specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.
By default, when a computer (or the DC Locator running on a computer, to be more specific) needs to locate a domain controller hosting an Active Directory domain specified with a single-label name, the computer exclusively uses NetBIOS name resolution, but not the DNS name resolution, unless the computer is joined to an Active Directory forest in which at least one domain has a single-label DNS name.
If this setting is enabled, computers to which this policy is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name using DNS name resolution.
If this setting is disabled, computers to which this setting is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name only using NetBIOS name resolution, but not the DNS name resolution, unless the computer is searching for a domain with a single label DNS name that exists in the Active Directory forest to which this computer is joined.
If this setting is not configured, it is not applied to any computers, and computers use their local configuration.</string>
<string id="Netlogon_AutoSiteCoverage">Automated Site Coverage by the DC Locator DNS SRV Records</string>
<string id="Netlogon_AutoSiteCoverage_Help">Determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites where no DC for the same domain exists (or no Global Catalog for the same forest exists). These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.
If this setting is enabled, the DCs to which this setting is applied dynamically register DC Locator site-specific DNS SRV records for the closest sites where no DC for the same domain, or no Global Catalog for the same forest, exists.
If you disable this setting, the DCs will not register site-specific DC Locator DNS SRV records for any other sites but their own.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_AvoidPdcOnWan">Contact PDC on logon failure</string>
<string id="Netlogon_AvoidPdcOnWan_Help">Defines whether a domain controller (DC) should attempt to verify with the PDC the password provided by a client if the DC failed to validate the password.
Contacting the PDC is useful in case the clientΓÇÖs password was recently changed and did not propagate to the DC yet. Users may want to disable this feature if the PDC is located over a slow WAN connection.
To enable this feature, click Enabled.
To disable this feature, click Disabled.</string>
<string id="Netlogon_BackgroundRetryInitialPeriod">Initial DC Discovery Retry Setting for Background Callers</string>
<string id="Netlogon_BackgroundRetryInitialPeriod_Help">When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting determines the amount of time (in seconds) before the first retry.
The default value for this setting is 10 minutes (10*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.
This setting is relevant only to those callers of DsGetDcName that have specified the DS_BACKGROUND_ONLY flag.
If the value of this setting is less than the value specified in the NegativeCachePeriod subkey, the value in the NegativeCachePeriod subkey is used.
Warning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value set in this setting is very small and the DC is not available, the traffic caused by periodic DC discoveries may be excessive.</string>
<string id="Netlogon_BackgroundRetryMaximumPeriod">Maximum DC Discovery Retry Interval Setting for Background Callers</string>
<string id="Netlogon_BackgroundRetryMaximumPeriod_Help">When applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC, the value set in this setting determines the maximum retry interval allowed.
For example, the retry intervals may be set at 10 minutes, then 20 minutes and then 40 minutes, but when the interval reaches the value set in this setting, that value becomes the retry interval for all subsequent retries until the value set in Final DC Discovery Retry Setting is reached.
The default value for this setting is 60 minutes (60*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.
If the value for this setting is smaller than the value specified for the Initial DC Discovery Retry Setting, the Initial DC Discovery Retry Setting is used.
Warning: If the value for this setting is too large, a client may take very long periods to try to find a DC.
If the value for this setting is too small and the DC is not available, the frequent retries may produce excessive network traffic.</string>
<string id="Netlogon_BackgroundRetryQuitTime">Final DC Discovery Retry Setting for Background Callers</string>
<string id="Netlogon_BackgroundRetryQuitTime_Help">When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting determines when retries are no longer allowed. For example, retires may be set to occur according to the Maximum DC Discovery Retry Interval Setting, but when the value set in this setting is reached, no more retries occur. If a value for this setting is smaller than the value in Maximum DC Discovery Retry Interval Setting, the value for Maximum DC Discovery Retry Interval Setting is used.
The default value for this setting is to not quit retrying (0). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.
Warning: If the value for this setting is too small, a client will stop trying to find a DC too soon.</string>
<string id="Netlogon_BackgroundSuccessfulRefreshPeriod">Positive Periodic DC Cache Refresh for Background Callers</string>
<string id="Netlogon_BackgroundSuccessfulRefreshPeriod_Help">Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. The default value for this setting is infinite (4294967200). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value is treated as infinity. The minimum value for this setting is to always refresh (0).</string>
<string id="Netlogon_DC_Locator_DNS_Records">DC Locator DNS Records</string>
<string id="Netlogon_DebugFlag_Help">Specifies the level of debug output for the Net Logon service.
The Net Logon service outputs debug information to the log file netlogon.log in the directory %windir%\debug. By default, no debug information is logged.
If you enable this setting and specify a non-zero value, debug information will be logged to the file. Higher values result in more verbose logging; the value of 536936447 is commonly used as an optimal setting.
If you specify zero for this setting, the default behavior occurs as described above.
If you disable this setting or do not configure it, the default behavior occurs as described above.</string>
<string id="Netlogon_DnsAvoidRegisterRecords">DC Locator DNS records not registered by the DCs</string>
<string id="Netlogon_DnsAvoidRegisterRecords_Help">Determines which Domain Controller (DC) Locator DNS records are not registered by the Netlogon service.
To enable this setting, select Enable and specify a list of space-delimited mnemonics (instructions) for the DC Locator DNS records that will not be registered by the DCs to which this setting is applied.
If this setting is disabled, DCs configured to perform dynamic registration of DC Locator DNS records register all DC locator DNS resource records.
If this setting is not applied to DCs, DCs use their local configuration.</string>
<string id="Netlogon_DnsRefreshInterval">Refresh Interval of the DC Locator DNS Records</string>
<string id="Netlogon_DnsRefreshInterval_Help">Specifies the Refresh Interval of the domain controller (DC) Locator DNS resource records for DCs to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC. This setting may be applied only to DCs using dynamic update.
DCs configured to perform dynamic registration of the DC Locator DNS resource records periodically reregister their records with DNS servers, even if their recordsΓÇÖ data has not changed. If authoritative DNS servers are configured to perform scavenging of the stale records, this reregistration is required to instruct the DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database.
Warning: If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Refresh Interval of the DC Locator DNS records to longer than the Refresh Interval of the DNS zones may result in the undesired deletion of DNS resource records.
To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes).
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_DnsTtl">TTL Set in the DC Locator DNS Records</string>
<string id="Netlogon_DnsTtl_Help">Specifies the value for the Time-To-Live (TTL) field in Net Logon registered SRV resource records. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the domain controller (DC).
To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes).
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_ExpectedDialupDelay">Expected dial-up delay on logon</string>
<string id="Netlogon_ExpectedDialupDelay_Help">Specifies the additional time for the computer to wait for the domain controllerΓÇÖs (DC) response when logging on to the network.
To specify the Expected dial-up delay at logon, click Enable, and then enter the desired value in seconds (for example, the value "60" is 1 minute).
If this setting is not configured, it is not applied to any computers, and computers use their local configuration.</string>
<string id="Netlogon_GcSiteCoverage">Sites Covered by the GC Locator DNS SRV Records</string>
<string id="Netlogon_GcSiteCoverage_Help">Specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the GC resides, and records registered by a GC configured to register GC Locator DNS SRV records for those sites without a GC that are closest to it.
The GC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the GC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. A GC is a domain controller that contains a partial replica of every domain in Active Directory.
To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format.
If this setting is not configured, it is not applied to any GCs, and GCs use their local configuration.</string>
<string id="Netlogon_LdapSrvPriority">Priority Set in the DC Locator DNS SRV Records</string>
<string id="Netlogon_LdapSrvPriority_Help">Specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used to locate the DC.
The Priority field in the SRV record sets the preference for target hosts (specified in the SRV recordΓÇÖs Target field). DNS clients that query for SRV resource records attempt to contact the first reachable host with the lowest priority number listed.
To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is 0 to 65535.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_LdapSrvWeight">Weight Set in the DC Locator DNS SRV Records</string>
<string id="Netlogon_LdapSrvWeight_Help">Specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.
The Weight field in the SRV record can be used in addition to the Priority value to provide a load-balancing mechanism where multiple servers are specified in the SRV records Target field and are all set to the same priority. The probability with which the DNS client randomly selects the target host to be contacted is proportional to the Weight field value in the SRV record.
To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is 0 to 65535.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_MaximumLogFileSize_Help">Specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled.
By default, the maximum size of the log file is 20MB. If this policy is enabled, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified.
If this policy is disabled or not configured, the default behavior occurs as indicated above.</string>
<string id="Netlogon_NdncSiteCoverage">Sites Covered by the Application Directory Partition Locator DNS SRV Records</string>
<string id="Netlogon_NdncSiteCoverage_Help">Specifies the sites for which the domain controllers (DC) housing application directory partition should register the site-specific, application directory partition-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it.
The application directory partition locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the application directory partition-specific DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.
To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_NegativeCachePeriod">Negative DC Discovery Cache Setting</string>
<string id="Netlogon_NegativeCachePeriod_Help">Specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. When a subsequent attempt to locate the DC occurs within the time set in this setting, DC Discovery immediately fails, without attempting to find the DC.
The default value for this setting is 45 seconds. The maximum value for this setting is 7 days (7*24*60*60). The minimum value for this setting is 0.
Warning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value for this setting is too small, clients will attempt to find DCs even when none are available.</string>
<string id="Netlogon_NetlogonShareCompatibilityMode_Help">This setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications.
When this setting is enabled, the Netlogon share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.
When this setting is disabled or not configured, the Netlogon share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.
By default, the Netlogon share will grant shared read access to files on the share when exclusive access is requested.
Note: The Netlogon share is a share created by the Net Logon service for use by client machines in the domain. The default behavior of the Netlogon share ensures that no application with only read permission to files on the Netlogon share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Netlogon share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Netlogon share on the domain will be decreased.
If this setting is enabled, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.</string>
<string id="Netlogon_NonBackgroundSuccessfulRefreshPeriod">Positive Periodic DC Cache Refresh for Non-Background Callers</string>
<string id="Netlogon_NonBackgroundSuccessfulRefreshPeriod_Help">Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that do not periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. This setting is relevant to only those callers of DsGetDcName that have not specified the DS_BACKGROUND_ONLY flag.
The default value for this setting is 30 minutes (1800). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value will be treated as infinity. The minimum value for this setting is to always refresh (0).</string>
<string id="Netlogon_ScavengeInterval_Help">Determines the interval at which Netlogon performs the following scavenging operations:
- Checks if a password on a secure channel needs to be modified, and modifies it if necessary.
- On the domain controllers (DC), discovers a DC that has not been discovered.
- On the PDC, attempts to add the <DomainName>[1B] NetBIOS name if it hasnΓÇÖt already been successfully added.
None of these operations are critical. 15 minutes is optimal in all but extreme cases. For instance, if a DC is separated from a trusted domain by an expensive (e.g., ISDN) line, this parameter might be adjusted upward to avoid frequent automatic discovery of DCs in a trusted domain.
To enable the setting, click Enabled, and then specify the interval in seconds.</string>
<string id="Netlogon_SiteCoverage">Sites Covered by the DC Locator DNS SRV Records</string>
<string id="Netlogon_SiteCoverage_Help">Specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it.
The DC Locator DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.
To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_SiteName">Site Name</string>
<string id="Netlogon_SiteName_Help">Specifies the Active Directory site to which computers belong.
An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.
To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory.
If this setting is not configured, it is not applied to any computers, and computers use their local configuration.</string>
<string id="Netlogon_SysvolShareCompatibilityMode_Help">This setting controls whether or not the Sysvol share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications.
When this setting is enabled, the Sysvol share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.
When this setting is disabled or not configured, the Sysvol share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.
By default, the Sysvol share will grant shared read access to files on the share when exclusive access is requested.
Note: The Sysvol share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the Sysvol share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Sysvol share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Sysvol share on the domain will be decreased.
If this setting is enabled, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator.</string>
<string id="Netlogon_UseDynamicDns">Dynamic Registration of the DC Locator DNS Records</string>
<string id="Netlogon_UseDynamicDns_Help">Determines if Dynamic Registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC.
If you enable this setting, DCs to which this setting is applied dynamically register DC Locator DNS resource records through dynamic DNS update-enabled network connections.
If you disable this setting, DCs will not register DC Locator DNS resource records.
If this setting is not configured, it is not applied to any DCs, and DCs use their local configuration.</string>
<string id="Netlogon_TryNextClosestSite">Try Next Closest Site</string>
<string id="Netlogon_TryNextClosestSite_Help">The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. The default behavior for DC Locator is to find a DC in the same site. If none are found in the same site, a DC in another site, which might be several site-hops away, could be returned by DC Locator. Site proximity between two sites is determined by the total site-link cost between them. A site is closer if it has a lower site link cost than another site with a higher site link cost. The Try Next Closest Site feature enables DC Locator to attempt to locate a DC in the nearest site based on the site link cost if a DC in same the site is not found. In scenarios with multiple sites, failing over to the try next closest site during DC Location streamlines network traffic more effectively.
If you enable this policy setting, Try Next Closest Site DC Location will be turned on for the machine across all available but un-configured network adapters.
If you disable this policy setting, Try Next Closest Site DC Location will not be used by default for the machine across all available but un-configured network adapters. However, if a DC Locator call is made using the DS_TRY_NEXTCLOSEST_SITE flag explicitly, the Try Next Closest Site behavior is honored.
If you do not configure this policy setting, Try Next Closest Site DC Location will not be used by default for the machine across all available but un-configured network adapters. If the DS_TRY_NEXTCLOSEST_SITE flag is used explicitly, the Next Closest Site behavior will be used.</string>
<string id="Netlogon_ForceRediscoveryInterval_Help">The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. When DC Locator finds a domain controller, it caches domain controllers to improve the efficiency of the location algorithm. As long as the cached domain controller meets the requirements and is running, DC Locator will continue to return it. If a new domain controller is introduced, existing clients will only discover it when a Force Rediscovery is carried out by DC Locator. To adapt to changes in network conditions DC Locator will by default carry out a Force Rediscovery according to a specific time interval and maintain efficient load-balancing of clients across all available domain controllers in all domains or forests. The default time interval for Force Rediscovery by DC Locator is 12 hours. Force Rediscovery can also be triggered if a call to DC Locator uses the DS_FORCE_REDISCOVERY flag. Rediscovery resets the timer on the cached domain controller entries.
If you enable this policy setting, DC Locator on the machine will carry out Force Rediscovery periodically according to the configured time interval. The minimum time interval is 3600 seconds (1 hour) to avoid excessive network traffic from rediscovery. The maximum allowed time interval is 4294967200 seconds, while any value greater than 4294967 seconds (~49 days) will be treated as infinity.
If you disable this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval.
If you do not configure this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval, unless the local machine setting in the registry is a different value.</string>
<string id="Netlogon_AddressTypeReturned">Domain Controller Address Type Returned</string>
<string id="Netlogon_AddressTypeReturned_Help">The Domain Controller (DC) Locator APIs return IP address of the DC with the other part of the information. Before the support of IPv6, the returned DC IP address was IPv4. But with the support of IPv6, the DC Locator APIs can return IPv6 DC address. The returned IPv6 DC address may not be correctly handled by some of the existing applications. So this policy is provided to support such scenarios.
By default, DC Locator APIs can return IPv4/IPv6 DC address. But if some applications are broken due to the returned IPv6 DC address, this policy can be used to disable the default behavior and enforce to return ONLY IPv4 DC address. Once applications are fixed, this policy can be used to enable the default behavior.
If you enable this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator.
If you disable this policy setting, DC Locator APIs will ONLY return IPv4 DC address if any. So if the domain controller supports both IPv4 and IPv6 addresses, DC Locator APIs will return IPv4 address. But if the domain controller supports only IPv6 address, then DC Locator APIs will fail.
If you do not configure this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator.</string>
<string id="Netlogon_AllowNT4Crypto">Allow cryptography algorithms compatible with Windows NT 4.0</string>
<string id="Netlogon_AllowNT4Crypto_Help">This setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Windows NT 4.0. The cryptography algorithms used in Windows NT 4.0 and earlier are not as secure as newer algorithms used in Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and this version of Windows.
By default, Net Logon will not allow the older cryptography algorithms to be used and will not include them in the negotiation of cryptography algorithms. Therefore, computers running Windows NT 4.0 will not be able to establish a connection to this domain controller.
If this setting is enabled, Net Logon will allow the negotiation and use of older cryptography algorithms compatible with Windows NT 4.0. However, using the older algorithms represents a potential security risk.</string>
<string id="Netlogon_IgnoreIncomingMailslotMessages">Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names</string>
<string id="Netlogon_IgnoreIncomingMailslotMessages_Help">This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC).
If you enable this policy setting, this DC does not process incoming mailslot messages that are used for NetBIOS domain nameΓÇôbased DC location.
If you disable or do not configure this policy setting, this DC processes incoming mailslot messages. This is the default behavior of DC Locator.
Note: To locate a remote DC based on its NetBIOS (single-label) domain name, DC Locator first gets the list of DCs from a WINS server that is configured in its local client settings. DC Locator then sends a mailslot message to each remote DC to get more information. DC location succeeds only if a remote DC responds to the mailslot message.
This policy setting is recommended to reduce the attack surface on a DC, and can be used in an environment without WINS, in an IPv6-only environment, and whenever DC location based on a NetBIOS domain name is not required. This policy setting does not affect DC location based on DNS names.
