Windows Firewall not recognizing Domain network
It may happen that your Windows Firewall profile does not always switch to Domain when you use a third-party VPN client. The reason behind the failure in changing to domain profile is the time lag in some third-party VPN clients. The delay occurs when the client adds the necessary routes to the domain network. VPNs change the IP address every time you switch to a new server or when you make a new connection. As a permanent solution, Microsoft recommends that the VPNs use callback APIs to add routes as soon as the VPN adapter arrives at Windows. These are the three API that a VPN should use for Windows.
NotifyUnicastIpAddressChange: Alerts callers of any changes to any IP address, including changes in DAD state.NotifyIpInterfaceChange: Registers a callback for notification of changes to all IP interfaces.NotifyAddrChanget: Notifies the user about address changes.
Workaround to switch Firewall to Domain Profile
If your VPN doesn’t offer such features, and you cannot switch to a different VPN, then here is a workaround. You or the IT admin can choose to disable negative cache to help the NLA service when it retries domain detection.
If you need to create any of these keys, right-click on any the appropriate pane, and select new and then the type of keys. Here you need right-click on the right pane and then select new DWORD.
Add or change Negative Cache Period
Disable Domain Discovery negative cache by adding the NegativeCachePeriod registry key to the following subkey
Open Registry Editor and navigate to the following key:
Change or create the following DWORD with the suggested valueName: NegativeCachePeriodType: REG_DWORDValue Data: 0
The default value of the negative cache is 45 seconds. Setting it to zero will disable caching. Add or change the Max Negative Cache TTL
If the issue is still not resolved, the next step is to disable DNS caching. You can achieve this by adding the MaxNegativeCacheTtl registry key.
Open Registry EditorNavigate to the following path:
Change or create the following DWORD with the suggested valueName: MaxNegativeCacheTtlType: REG_DWORDValue Data: 0
The default value of the max negative cache is five seconds. When you set it to zero, it will disable caching. I hope the workaround helped Windows Firewall profile to switch to Domain profile when you use a third-party VPN client. Unless your VPN client supports the callback API to notify about change, the Registry changes should help.
