Microsoft has confirmed a new known issue affecting Windows Server 2016 systems that causes domain controller lookups to fail after installing the KB5087537 May 2026 security update.
Windows Server 2016 reached the end of mainstream support in January 2022, but Microsoft has pushed back the extended support end date by 5 years to allow customers to migrate to newer Windows Server versions.
As the company explained in an updated support document, this affects only devices with hostnames exactly 15 characters long.
“After installing this update, domain controller discovery might fail on Windows Server 2016 systems when the server hostname is 15 characters long,” Microsoft said.
“When the hostname is 15 characters long, DCLocator calls (for example, using nltest /dsgetdc:
Microsoft also noted that this known issue may also affect certain administrative scenarios that require access to a domain controller.
“As a result, administrative operations that rely on domain controller lookup might fail, impacting scenarios such as DFS Namespace management,” it noted.
The company is now investigating the domain controller lookup issues and has not yet provided a timeline for resolving them.
In recent weeks, Microsoft has also confirmed Windows Update failures after installing the January 2026 optional non-security preview updates in restricted network environments, as well as Windows 11 security update deployment issues due to insufficient free space on the EFI System Partition (ESP).
Last month, it warned admins that some Windows Server 2025 devices may boot into BitLocker recovery and released emergency out-of-band updates to fix issues causing Windows Server systems with domain controller roles to enter a restart loop.
In April, Microsoft also finally addressed a bug that had been plaguing Windows servers since September 2024, causing devices running Windows Server 2019 and Windows Server 2022 to upgrade to Windows Server 2025 “unexpectedly.”
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
