Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. NetSetup.LOG
LogRisk: Caution

NetSetup.LOG C:\Windows\debug\NetSetup.LOG

Log of domain join and unjoin operations (NetJoin); the first file to check when a computer fails to join a domain.

Updated on By AltF4 Formation

What it’s for

NetSetup.LOG records a computer joining a domain (or a workgroup) and being removed from a domain. It is the first file to open when a join fails: it shows domain controller discovery, creation or reuse of the computer account, and the step that breaks.

What it contains

  • The internal join calls (NetpXxx functions) with their parameters: domain name, computer name, domain controller contacted.
  • DNS results and error codes, often more precise than the message shown on screen: 0x54b (domain not found or unreachable), 0x525 (account does not exist), 0x5 (access denied).
  • Computer account details, the organizational unit and the DNS name update steps.

Risks and best practices

  • Deleting it does not affect Windows, but it erases the trace of past joins, so keep it during a diagnosis.
  • It contains computer, domain and controller names: review it before sending it to a third party.

Useful commands

Fenêtre de terminal
# Last lines of the log
Get-Content "$env:windir\debug\NetSetup.LOG" -Tail 60


# Error or failure lines
Select-String -Path "$env:windir\debug\NetSetup.LOG" -Pattern 'failed|error|0x[0-9a-f]{3,8}' | Select-Object -Last 30
Fenêtre de terminal
:: Can the machine find a domain controller? (replace with your domain)
nltest /dsgetdc:contoso.local

Format

Text file. Each line starts with the date and time (MM/DD/YYYY hh:mm:ss:ms), followed by the name of the emitting function (for example NetpDoDomainJoin) and the message.

Rotation and archiving

Copy the file before reproducing a join if you want to keep the history of the previous attempt.

How to read it

Go to the end of the file, find the time of the attempt, then scroll up to the first line carrying an error code: that is usually the cause (DNS, access to the domain controller, existing account). Cross-check with netlogon.log and the System log.

Report a mistake