Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. netlogon.log
LogRisk: Caution

netlogon.log C:\Windows\debug\netlogon.log

Netlogon service debug log: domain controller discovery, secure channel, authentication; active only when enabled.

Updated on By AltF4 Formation

What it’s for

Once debug logging is enabled, Netlogon traces here everything that touches the secure channel between a machine and its domain controller. You open it to understand a failed domain sign-in, a domain controller lookup that lands on the wrong site, a subnet problem or a broken trust relationship.

What it contains

  • Domain controller lookups (DC locator) and their results.
  • Secure channel setup and errors, pass-through authentications.
  • Domain controller DNS record updates.

Neighboring file: PASSWD.LOG

A PASSWD.LOG file may sit next to netlogon.log, related to account password changes. It is rarely present, and absent or empty on a healthy machine. If it exists, review it with the same care as netlogon.log (account and machine names) and cross-check the Security log. Deleting it has no effect on Windows.

Risks and best practices

  • Debug logging is off by default. Enable it for the duration of the diagnosis, then turn it off: left on permanently, it costs disk and resources on a busy domain controller.
  • The log contains account and machine names, so protect it.
  • Deleting the file has no consequence for Windows. Netlogon recreates it.

Useful commands

Fenêtre de terminal
:: Enable debug logging (as administrator)
nltest /dbflag:0x2080ffff


:: Disable it (as administrator)
nltest /dbflag:0x0
Fenêtre de terminal
# Last lines
Get-Content "$env:windir\debug\netlogon.log" -Tail 50


# Look for clients with no site assigned
Select-String -Path "$env:windir\debug\netlogon.log" -Pattern "NO_CLIENT_SITE"

Format

Text file. Each line has the date (MM/DD), the time, a category in brackets (for example [LOGON], [SESSION], [CRITICAL], [MISC]) and then the message.

Rotation and archiving

By default the maximum size is 20 MB: when the file reaches it, it is renamed to Netlogon.bak and a new netlogon.log is created. Only one .bak file is kept; archive it before it is overwritten.

How to read it

Find the time of the failure, then read the [LOGON] and [SESSION] lines to follow authentication and secure channel state. [CRITICAL] lines and status codes (0xC000…) point to the cause.

Report a mistake