During ODMAD Credential Cache (GetCred) operations, users may receive the following error when entering target domain credentials:
LogonUser: We can't sign you in with this credential because your domain isn't available.
This may occur even when domain controller discovery (nltest /dsgetdc) succeeds and general connectivity appears healthy.
The issue is not caused by ODMAD but by how Windows processes authentication through the LogonUser() API.
LogonUser() performs real-time authentication and:
nltestAuthentication may fail with “domain isn’t available” under the following conditions:
CORP\username) triggers a different authentication path than UPNBecause DC selection and authentication are dynamic, the issue appears intermittent and user-specific.
This is an environmental authentication issue. Use the following mitigation and validation steps:
Prefer UPN format for Credential Cache:
username@corp.target.local
Validate authentication behavior:
runas /netonly /user:CORP\username cmd
runas /netonly /user:username@corp.target.local cmd
Verify all domain controllers are reachable and resolvable:
nltest /dclist:corp.target.local
Resolve-DnsName corp.target.local -Type SRV
Review Event Logs:
Check NTLM restriction policies:
Ensure consistent DNS configuration across sites
If reproducible, capture network trace to identify failing DC or authentication path