Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. netlogon.bak
LogRisk: Caution

netlogon.bak C:\Windows\debug\netlogon.bak

netlogon.bak: previous version of netlogon.log, created when it reaches its maximum size (20 MB by default); only one .bak file is kept.

Updated on By AltF4 Formation

What it’s for

When netlogon.log reaches its maximum size, 20 MB by default, Netlogon renames it to netlogon.bak and starts a new netlogon.log. The .bak is therefore the previous period of the same debug log. It only appears once the log has filled up, and only the latest one is kept: the next rotation overwrites it.

What it contains

  • The same lines as netlogon.log, for the preceding period: domain controller discovery, secure channel, authentication, DNS or site errors.
  • Nothing else: if Netlogon debug logging was never enabled, neither the .log nor the .bak exists.

Risks and best practices

  • A diagnosis that goes back in time must read both files: the event you want may be in the .bak if the .log has just restarted.
  • On a busy domain controller, 20 MB fills quickly in verbose mode. Raise the MaximumLogFileSize value (in bytes) under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters to keep more history.
  • Turn verbose logging off once the diagnosis is done: it consumes space and I/O.

Useful commands

Fenêtre de terminal
:: Enable verbose Netlogon logging (as administrator)
nltest /dbflag:0x2080ffff


:: Turn it off once the diagnosis is done
nltest /dbflag:0x0
Fenêtre de terminal
# Last lines of the old log
Get-Content "$env:windir\debug\netlogon.bak" -Tail 50


# Domain controller discovery errors across old and new logs
Select-String -Path "$env:windir\debug\netlogon.*" -Pattern 'NO_CLIENT_SITE|DsGetDcName|0x[0-9a-f]{4,8}' | Select-Object -Last 30

Format

Text file, a copy of netlogon.log at the time of rotation. Each line starts with the date and time.

Rotation and archiving

Rotation happens at the maximum size (20 MB by default); a single .bak is kept. Copy it before another rotation overwrites it.

How to read it

Like netlogon.log: find the time of the incident, then the error lines. If the time is not in the .log, look in the .bak.

Report a mistake