Troubleshooting "Invalid Credentials" Errors During an Offline Domain Join Migration
Learn how to determine whether an "Invalid Credentials" error is caused by incorrect credentials or by the workstation being unable to communicate with a source domain controller.
Written by Jamie Richard
Updated at July 16th, 2026
Table of Contents
Problem
During an Offline Domain Join (ODJ) migration, the Migration Agent validates the supplied target credentials by requesting Windows to authenticate them against the source Active Directory domain. This authentication occurs through the trust relationship between the source and target domains.
If Windows is unable to complete the authentication request, the Migration Agent may report the failure as an Invalid Credentials error. While this can indicate an incorrect username or password, it can also be caused by other authentication failures, including:
- The workstation cannot communicate with a source domain controller.
- Network connectivity or VPN issues.
- DNS resolution problems.
- The user account does not exist.
- The user account is locked out.
- Other Windows authentication failures.
Reviewing the corresponding Windows Security event allows you to determine the underlying cause of the authentication failure.
Diagnosing the Failure
When the authentication request fails, Windows records an Event ID 4625 - An account failed to log on in the Security event log on the endpoint / client.
Open Event Viewer.
Navigate to Windows Logs → Security.
Locate an Event ID 4625 that occurred at the same time as the failure.
The event typically contains:
Subject – The currently logged on source domain user initiating the request.
Account For Which Logon Failed – The target credentials supplied to the Migration Agent.
Status – The Windows NTSTATUS code indicating why the authentication request failed.
Status Code Reference
The Status field identifies the underlying cause of the authentication failure.
| Status | Meaning |
|---|---|
| 0xC000005E | No logon servers are available. The workstation cannot communicate with a source domain controller. |
| 0xC000006A | Incorrect password. |
| 0xC0000064 | User account does not exist. |
| 0xC000006D | Generic logon failure. |
| 0xC0000234 | Account is locked out. |
Example
If Event ID 4625 contains:
Status: 0xC000005EWindows was unable to contact a source domain controller to authenticate the supplied target credentials.
Although the Migration Agent may report this as an Invalid Credentials error, the underlying issue is that the workstation cannot communicate with the source Active Directory domain.
Resolution
If the status code is 0xC000005E, verify that the workstation has connectivity to the source Active Directory domain controllers.
Common items to verify include:
The VPN is connected and functioning correctly.
DNS resolves the source domain controllers.
Required Active Directory ports (Kerberos, LDAP, SMB, RPC, etc.) are permitted across the VPN.
Confirm the workstation can locate a source domain controller using:
nltest /dsgetdc:<source_domain>or verify the secure channel using:
nltest /sc_verify:<source_domain>Once communication with a source domain controller has been restored, have the user attempt to cache their credentials again.
Other Status Codes
A status code other than 0xC000005E indicates that Windows successfully communicated with a source domain controller and received an authentication response.
These authentication failures should be investigated based on the status code returned by Windows. Troubleshooting may include verifying the supplied credentials, confirming the user account exists and is not locked out, and ensuring the trust relationship between the source and target Active Directory domains is healthy and functioning correctly.