debug C:\Windows\debug

Folder for Windows component debug logs, mainly netlogon.log (Netlogon service); nearly empty while no debug logging is on.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Netlogon writes its debug log, netlogon.log, here as soon as debug logging is enabled. That is the case Microsoft documents, and the one you meet in practice when diagnosing domain authentication failures. Other components may drop their own files here, depending on the version and the installed roles.

What it contains

netlogon.log: Netlogon service activity (domain authentication, secure channel). When it reaches 20 MB by default, it is renamed netlogon.bak and a new file is started.
Sometimes other component logs, such as PASSWD.LOG.
Almost nothing if no debug logging is active.

Risks and best practices

Keep these logs until a domain authentication diagnosis is finished, since they are the only detailed trace of the secure channel.
Netlogon logging can take up to twice the configured maximum size (the file plus its .bak). Turn it off when the diagnosis is over.
The files mention account and machine names, so treat them as internal data and archive them before purging.

Useful commands

# Last lines of the Netlogon log, if it exists
Get-Content "$env:windir\debug\netlogon.log" -Tail 30

# Netlogon logging level (DBFlag value, absent if not configured)
reg query HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters /v DBFlag

Folder contents

Folders 2

Logs 7

Report a mistake