Netlogon debug logging is a built-in Windows diagnostic feature used to investigate domain authentication, secure channel communication, domain controller discovery, trust relationships, and related Active Directory connectivity problems. When enabled, it records detailed Netlogon service activity that can help administrators trace a workstation, member server, or domain controller cannot authenticate properly or locate the expected domain services.
The Netlogon log is especially useful when troubleshooting intermittent logon failures, broken domain trust errors, failed secure channel validation, slow domain controller discovery, site selection issues, and replication-adjacent authentication symptoms. By enabling logging with the proper administrative commands and reviewing the generated files in the Windows debug folder, you can often identify failed DC lookups, rejected credentials, DNS or site mapping problems, and secure channel negotiation failures.
When logging Netlogon activity, Outbyte PC Repair can scan Windows settings and system elements for additional authentication-related issues.
As an Amazon Associate I earn from qualifying purchases.
Because Netlogon logging can generate large files and may capture sensitive domain-related details, it should be enabled only for the duration of troubleshooting and disabled once the required data has been collected. A structured approach—turning logging on, reproducing the issue, reviewing the relevant entries, and then turning logging off—keeps the process efficient and reduces unnecessary log growth.
When to Use Netlogon Logging
Netlogon logging is most useful when Windows domain authentication behavior is inconsistent, delayed, or difficult to trace from standard event logs alone. The Netlogon service participates in domain controller discovery, secure channel maintenance, pass-through authentication, and domain trust operations. Enabling its debug log can show which domain controller a computer contacted, how site-aware discovery behaved, whether a secure channel request succeeded, and which errors were returned during the process.
#1 Best Overall
- rv toilet brush: Engineered specifically for RVs, this brush features a silicone head that gently cleans without damaging the toilet bowl or seals, a must for traditional toilet brushes.
- Compact Wall-Mounted Toilet Brush: With its space-saving design, this brush is easy to stow away discreetly, perfect for the limited space in RVs.
- silicone toilet brush: This brush is designed for thorough cleaning of the toilet bowl without causing any harm to the porcelain or seals. The drip-free toilet brush holder is crafted to collect water from the brush, preventing any mess on your RV's floor.
- Wall-Mounted Toilet Brush for RV Travel: The brush head is conveniently attachable to the bathroom wall, ensuring that there's no rolling around during your trips. With this setup, you can travel with peace of mind, knowing your toilet brush is securely in place.
Use Netlogon logging when a workstation, member server, or domain controller appears to have trouble locating a suitable domain controller. Common symptoms include slow sign-ins, intermittent “domain not available” messages, Group Policy processing failures, mapped drives that do not appear at sign-in, or applications that fail only when they rely on domain credentials. In these cases, the log can reveal DNS lookup behavior, domain controller selection, site mapping, and retry patterns that may not be visible in the System or Directory Service event logs.
Common scenarios for enabling Netlogon logging
- Secure channel problems: Use it when a computer account trust relationship is suspected to be broken, or when tools such as nltest, Test-ComputerSecureChannel, or domain join operations return secure channel errors.
- Domain controller discovery failures: Enable it when clients authenticate against remote domain controllers instead of local-site domain controllers, or when logon traffic crosses unexpected network links.
- Authentication failures: Use it to investigate NTLM pass-through authentication failures, repeated credential prompts, application sign-in failures, or inconsistent access to file shares and legacy services.
- Trust relationship issues: Enable it on systems involved in cross-domain or cross-forest authentication when users from one domain cannot access resources in another domain.
- Intermittent logon delays: Use it during a defined test window to capture slow startup, delayed Group Policy application, or authentication timeouts that occur only at certain times or locations.
Netlogon logging is also valuable during network, DNS, or Active Directory site changes. If subnet mappings, site links, domain controller placement, firewall rules, or DNS records have recently changed, the log can confirm whether clients are discovering domain controllers as expected. It can also help distinguish an Active Directory configuration problem from a network connectivity issue, such as blocked ports, missing SRV records, unreachable domain controllers, or incorrect site assignment.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Because debug logging can generate a large amount of data, it is best used for targeted troubleshooting rather than left enabled continuously. Choose the affected machine carefully: enable logging on the client for logon or domain controller discovery problems, on the member server for application or file share authentication issues, and on a domain controller when investigating pass-through authentication, trust validation, or domain-wide secure channel activity. Capture the failure, record the time it occurred, then compare the Netlogon log entries with Security, System, DNS Client, Group Policy, and Directory Service events to build a complete timeline.
Prerequisites and Administrative Considerations
Before enabling Netlogon debug logging, confirm that you are working on the right Windows system for the symptom you are investigating. For client logon failures, password trust issues, or domain controller discovery problems, enable logging on the affected workstation or member server. For domain-wide authentication failures, secure channel resets, replication-adjacent symptoms, or failed pass-through authentication, you may need logs from one or more domain controllers as well as the affected client. Netlogon logging is local to the machine where it is enabled, so collecting it from only one endpoint may not show the complete authentication path.
You need local administrative privileges on the target computer to enable or disable Netlogon debug logging. On domain controllers, use an elevated Command Prompt or PowerShell session opened with an account that has appropriate administrative rights. In most cases, the built-in nltest utility is already available on supported Windows client and server versions. The typical command used later in the process is nltest /dbflag:0x2080ffff, and it must be run in an elevated session. If you are enabling logging remotely, account for User Account Control, remote management policy, endpoint protection controls, and whether your remote shell is actually elevated.
Plan for disk usage before turning on verbose logging, especially on busy domain controllers. Netlogon writes to %windir%\debug\netlogon.log and may roll older data into %windir%\debug\netlogon.bak. The log can grow quickly during heavy authentication traffic, group policy refreshes, service account activity, or repeated domain controller locator attempts. Check free space on the system drive and avoid leaving verbose logging enabled for longer than needed. A focused capture window is usually best: enable logging, reproduce the problem, copy the logs, then disable logging.
Recommended Free Tools
Consider timing and correlation before you begin. Record the affected username, computer name, domain, source IP address if relevant, approximate failure time, and the exact error observed by the user or application. Make sure the system clock is accurate and synchronized, because Netlogon analysis often depends on matching events with Security logs, System logs, DNS client events, Kerberos events, application logs, firewall logs, and domain controller logs. If several systems are involved, synchronized time across clients, member servers, and domain controllers is essential.
Administrative checklist
- Scope the target systems: identify whether logging is needed on the client, member server, domain controller, or multiple systems.
- Use elevation: run commands from an elevated Command Prompt or PowerShell window.
- Verify permissions: ensure the account can administer the target system and access %windir%\debug.
- Check disk space: confirm that the Windows volume has enough free space for verbose logs.
- Define a capture window: enable logging only long enough to reproduce or observe the issue.
- Preserve context: document times, names, domains, IP addresses, error codes, and the user action that triggered the failure.
- Coordinate on domain controllers: avoid unnecessary logging across all domain controllers unless the issue is intermittent or site-wide.
In production environments, treat Netlogon logging as a temporary diagnostic change. Although it is commonly used and does not require a reboot in normal usage, it can add overhead and generate sensitive operational data. The log may include domain names, computer names, account names, trust names, site names, and authentication flow details. Store copied logs in a controlled location, share them only with personnel involved in troubleshooting, and remove stale diagnostic files when they are no longer needed.
How to Enable Netlogon Debug Logging
Netlogon debug logging is enabled by setting the Netlogon service debug flag with the built-in nltest command. Run the command from an elevated Command Prompt or elevated PowerShell session on the Windows computer where you want to capture activity. This can be a domain controller, member server, or domain-joined workstation, depending on where the authentication, secure channel, or domain controller discovery problem is being observed.
Rank #2
- Easy Identification: Made of a high quality zinc alloy, with a transparent cover and color coded
- 14 Most Common Fuses: Standard and Mini. (5A/ 7.5A/ 10A/ 15A/ 20A/ 25A/ 30A)
- Wide Applications: Fits most vehicles like car, truck, marine, SUV, travel trailer and other vehicles
- Note: Please use the right amp fuse to protect the vehicle and electronic equipment from short-circuit/overload
- ll Sizes You Need: The package contains 140pcs fuse and 2pcs fuse puller - 70pcs standard fuse and 70pcs mini fuse. (10pcs of each AMP)
To enable the standard verbose Netlogon log, run the following command:
nltest /dbflag:0x2080ffff
This setting turns on detailed Netlogon tracing and writes events to the Netlogon debug log. In most troubleshooting cases, 0x2080ffff is the preferred value because it captures a broad set of Netlogon activity, including domain controller discovery, secure channel operations, pass-through authentication, trust activity, and related status codes. The command takes effect immediately; a reboot is not required.
Enable logging on a remote computer
If you have the required administrative permissions and network access, you can enable Netlogon logging remotely by specifying the target computer name:
nltest /server:SERVER01 /dbflag:0x2080ffff
Replace SERVER01 with the name of the server, workstation, or domain controller you want to trace. For domain controller troubleshooting, enable logging on the domain controller that clients are actually using, not just any domain controller in the domain. You can identify the current logon server from a client by running:
echo %LOGONSERVER%
You can also use nltest /dsgetdc:domain.example.com to test domain controller discovery from a client and then enable logging on the client, the returned domain controller, or both.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsConfirm that the debug flag is enabled
After enabling logging, verify the active Netlogon debug flag with:
nltest /dbflag
On a remote system, use:
nltest /server:SERVER01 /dbflag
The output should show the configured debug value. If the command fails with access denied, run the shell as an administrator and confirm that your account has local administrative rights on the target machine. If the command cannot reach the remote computer, check firewall rules, name resolution, Remote Service Management access, and whether the Netlogon service is running.
Generate useful log activity
Once logging is enabled, reproduce the issue as closely as possible. For authentication problems, attempt the failed sign-in, access the affected file share, connect to the application, or retry the service operation that triggers the failure. For secure channel issues, test the channel from the affected machine with:
nltest /sc_verify:domain.example.com
For domain controller discovery problems, run:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- ✅ Organize Your Freezer with a Complete Ice System: This ice cube tray with lid and bin set solves freezer clutter by combining 4 silicone ice cube trays, a central storage container, and a scoop. Keep your kitchen tidy while always having ice ready for daily drinks, cooking, or entertaining.
- ✅ Easy-Pop Ice Release with Secure Non-Spill Lids: Each silicone ice tray features a flexible bottom for effortless ice cube removal—simply push from below. The ice tray with lid has lift tabs for easy handling and minimizes spills when moving (note: lids allow airflow and are not airtight).
- ✅ Maximize Freezer Space with Stackable Design: These ice trays for freezer stack neatly to save vertical space. Perfect for compact apartment freezers, RV refrigerators, or organizing multiple ice cube trays for freezer for parties and home use.
- ✅ BPA-Free and Odor-Resistant for Pure Ice Taste: Made from food-grade silicone and durable plastic, these ice trays resist absorbing freezer odors. Ensure clean, tasteless ice for your cocktails, coffee, or family meals with these BPA-free ice trays.
- ✅ Versatile and Dishwasher Safe for Easy Cleanup: Create clear cubes or infuse with fruits for flavored ice. The entire ice bucket kits set is top-rack dishwasher safe, making cleanup simple and convenient after parties or daily use.
nltest /dsgetdc:domain.example.com /force
Capturing a short, focused time window is usually better than leaving logging enabled for hours. Record the approximate time of each test, the client name, the user account, the target resource, and the domain controller involved. These details make it much easier to match entries in Netlogon.log to the failed operation and to separate relevant failures from normal background domain traffic.
- Client-side logging helps diagnose domain controller discovery, secure channel, and workstation authentication behavior.
- Domain controller logging helps diagnose pass-through authentication, trust, replication-adjacent authentication symptoms, and account lookup failures.
- Logging on both sides is useful when the failure path is unclear or when intermittent authentication failures involve multiple domain controllers.
Where to Find and Manage Netlogon Log Files
After Netlogon debug logging is enabled, Windows writes the primary log file to %windir%\debug\netlogon.log, which typically resolves to C:\Windows\debug\netlogon.log. On domain controllers, member servers, and domain-joined clients, this is the first file to check when investigating domain controller discovery, secure channel validation, account authentication, or trust-related behavior. The file is plain text and can be opened with pad, PowerShell, or a log viewer that handles large files more comfortably.
Netlogon also uses a rollover file named netlogon.bak in the same folder. When netlogon.log reaches its configured size limit, Windows renames the current file to netlogon.bak and starts a fresh netlogon.log. If netlogon.bak already exists, it is overwritten. This means only the current log and one previous log are retained by default, so copy both files before restarting services, reproducing an issue repeatedly, or leaving logging enabled for an extended period.
Common locations and files
| Item | Default path | Use |
|---|---|---|
| Current Netlogon log | C:\Windows\debug\netlogon.log | Active debug output from the Netlogon service |
| Previous Netlogon log | C:\Windows\debug\netlogon.bak | Rolled-over copy of the prior log |
| Debug folder | C:\Windows\debug | Folder containing Netlogon and other Windows debug logs |
To inspect the file from an elevated PowerShell session, use commands such as Get-Content C:\Windows\debug\netlogon.log -Tail 100 for the most recent entries or Get-Content C:\Windows\debug\netlogon.log -Wait to watch new lines while reproducing a problem. For targeted review, filter for terms tied to the symptom, such as NO_CLIENT_SITE, DsGetDcName, NetrLogonSamLogon, STATUS_ACCESS_DENIED, STATUS_NO_LOGON_SERVERS, the affected username, the client computer name, or a domain controller name.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Log management matters because Netlogon debug logging can produce frequent writes on busy systems, especially domain controllers. Before collecting data, confirm free disk space on the system drive and agree on a short capture window that includes the failing operation. If you need to preserve evidence, copy the files to a working folder with a timestamped name, such as netlogon-DC01-2026-05-25-1430.log. Avoid editing the original file in place; some editors can lock the file or change formatting. If the log is very large, use PowerShell, findstr, or a dedicated log viewer rather than loading the whole file into a basic text editor.
- Collect both files: copy netlogon.log and netlogon.bak when troubleshooting spans a rollover event.
- Record the time window: note the exact time the issue was reproduced and compare it with log timestamps.
- Correlate with other data: compare entries with System event logs, Security logon events, DNS client behavior, and domain controller availability.
- Protect sensitive content: Netlogon logs can include domain names, computer names, usernames, site names, IP addresses, and authentication status codes.
For remote collection, administrative shares can be used when permitted, for example \\SERVER01\C$\Windows\debug\netlogon.log. In locked-down environments, use a controlled collection method such as PowerShell remoting, an endpoint management tool, or a temporary copy to a secured share. Once the capture is complete, archive the logs with the related case s so that later analysis can match the log entries to the affected user, workstation, domain controller, and test time.
How to Read Common Netlogon Log Entries
Netlogon debug output is usually written in chronoal order, so start by matching the timestamp in Netlogon.log to the exact time of the failed sign-in, password change, domain join, Group Policy refresh, or application authentication event. The log is verbose, and a single failure can generate many surrounding entries. Focus first on the client name, domain name, domain controller name, and status code. These fields usually tell you whether the problem is related to domain controller discovery, the computer account secure channel, name resolution, time synchronization, or credential validation.
A typical line may include a timestamp, process or thread marker, the Netlogon function being called, and a result. Entries that mention DsGetDcName or DsrGetDcNameEx2 are related to domain controller location. Entries that mention NetrServerAuthenticate, NetrLogonSamLogon, SamLogon, or Secure Channel are usually tied to authentication or trust validation. Status values are often shown as hexadecimal codes, such as 0x0 for success, or as Windows error names such as STATUS_NO_LOGON_SERVERS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common entries and what they usually indicate
| Log pattern | Typical meaning | What to check next |
|---|---|---|
| DsGetDcName | The computer is trying to locate a suitable domain controller. | DNS records, AD site mapping, subnet definitions, network reachability, and firewall rules. |
| NO_CLIENT_SITE | The client IP address does not map to an Active Directory site. | Active Directory Sites and Services subnet configuration. |
| STATUS_NO_LOGON_SERVERS | No domain controller was available for the requested operation. | DNS resolution, DC health, VPN connectivity, routing, and required ports. |
| STATUS_ACCESS_DENIED | The request reached a server, but the operation was refused. | Computer account state, trust relationship, permissions, and security policy changes. |
| STATUS_WRONG_PASSWORD | A credential or machine account password did not match. | Account lockout history, password changes, stale sessions, or broken secure channel. |
| NetrServerAuthenticate failed | The secure channel between the machine and domain could not be established. | Computer account password, domain membership, replication, and secure channel repair. |
For domain controller discovery issues, search for the client hostname and then review nearby DsGetDcName entries. A healthy lookup commonly ends with a selected domain controller and a success status. If the log repeatedly shows failed discovery attempts, confirm that the client can resolve _ldap._tcp.dc._msdcs.<domain> SRV records and can reach the returned domain controllers. If the client is choosing a remote domain controller, look for site-related lines and verify that the client subnet is correctly assigned in Active Directory Sites and Services.
Rank #4
- 【Food Grade Material】Made from eco-friendly PP+TPR material that is BPA Free and Food-Grade. The flexible material allows the dish strainers for kitchen counter to collapse flat for easy space-saving and storage, making the most of your kitchen countertop.
- 【Built-in Utensil Drying Rack】Separate storage area for utensils and gadgets, the non-slip dish drying rack is scratch-proof and offers a safe place for plates and cups, and has a separate compartment for cutlery. Perfect for storage and draining dinnerware and glassware.
- 【Compact and Portable】The collapsible dish drainer is simply pop-up to open when using and collapses to flat for space-saving storage, you can easily store it under the sink or slip it into any cabinet. Suitable for both indoors & outdoors uses, such as camping, BBQ, RV and boats, campsite cleanup, and vacation homes, etc.
- 【Drying Water Quickly】The collapsible dish storage rack versatile tool for all your household tasks, at the same time, will not hurt your hands or scratch the sink. The Bottom with an adjustable swivel drain strip allows water to run directly into the sink, keeping your counters clean and dry.
- 【Easy to Maintain】Heavy-duty plastic is simple to wipe clean, and there’s no rusting like the old clunky metal dish drying rack. The kitchen organizers for dishes is scratch-proof and offers a safe place for plates and cups, and prevent the rack from shifting and scratching any counter top.
For secure channel and authentication issues, search for SamLogon, NetrLogonSamLogon, the affected username, or the computer account name ending in $. A failed secure channel often appears as repeated authentication failures involving the local computer account rather than the human user account. Compare the Netlogon timestamp with Security event log entries on the client and domain controller, especially events for failed logon, account lockout, Kerberos pre-authentication failure, or trust failures. If several domain controllers show different results for the same account, check Active Directory replication and confirm that password or computer account changes have replicated.
Use error codes as pivots rather than reading every line from top to bottom. Copy the hexadecimal status code and translate it with tools such as net helpmsg, Microsoft documentation, or event log details. Also watch for repetition: one isolated failure during startup may be harmless, while the same failure every few seconds usually points to a persistent DNS, network, trust, or account problem. After identifying the failing operation, correlate Netlogon data with dcdiag, nltest, DNS queries, firewall logs, and Windows Security logs to confirm the root cause before making changes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting Common Authentication and Domain Issues
Netlogon logging is most useful when you connect log entries to a specific symptom, client, domain controller, and time window. Start by reproducing the failure, noting the exact timestamp, username, workstation name, domain, and error shown to the user or service. Then compare the entries in %SystemRoot%\debug\netlogon.log on the affected computer and, when relevant, on the domain controller handling the request. This helps separate local secure channel problems from domain controller discovery, DNS, replication, or credential validation issues.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Domain controller discovery failures
If a workstation cannot find a domain controller, look for entries related to DsGetDcName, DC Locator, site discovery, and DNS lookups. Repeated failures to locate a DC often point to incorrect DNS client settings, missing SRV records, firewall filtering, or Active Directory site/subnet misconfiguration. For example, if the log shows attempts to query a domain but no suitable DC is returned, verify that the client uses domain DNS servers rather than public resolvers, then check records such as _ldap._tcp.dc._msdcs.example.com with nslookup or Resolve-DnsName.
- Symptom: “There are currently no logon servers available.”
- Log focus: DC Locator calls, DNS query failures, site selection, returned DC names.
- Checks: DNS server configuration, SRV records, client subnet mapping, TCP/UDP 389, 445, 88, and 53 reachability.
Secure channel and trust relationship problems
For computer account trust failures, Netlogon commonly records secure channel setup attempts, failed authentications, or status codes such as STATUS_ACCESS_DENIED or STATUS_NO_TRUST_SAM_ACCOUNT. These entries can indicate that the computer account password is out of sync with Active Directory, the account was reset or restored incorrectly, or the machine is contacting a DC that has stale replication data. Confirm the secure channel with Test-ComputerSecureChannel -Verbose on clients or nltest /sc_verify:domain.example. If repair is appropriate, use Test-ComputerSecureChannel -Repair -Credential domain\adminuser or rejoin the domain after validating replication health.
Intermittent logon delays and wrong-site domain controllers
When users can log on but experience long delays, examine whether the client is selecting a remote domain controller instead of one in the local site. Netlogon entries may show the chosen DC, site name, flags, and rediscovery behavior. A client in the wrong site often suggests missing or incorrect subnet definitions in Active Directory Sites and Services. Compare the client IP address to configured AD subnets, verify site links, and confirm that local DCs advertise the expected services. Commands such as nltest /dsgetsite and nltest /dsgetdc:domain.example /force are useful companions to the log.
| Issue | Netlogon evidence | Practical next step |
|---|---|---|
| Bad DNS configuration | DC discovery failures or no DC returned | Point clients to AD-integrated DNS and verify SRV records |
| Broken secure channel | Failed secure channel validation or access denied status | Run Test-ComputerSecureChannel or nltest /sc_verify |
| Wrong AD site | Remote DC selected during locator process | Correct subnet-to-site mapping in AD Sites and Services |
| Replication inconsistency | Different results depending on selected DC | Check repadmin /replsummary and DC event logs |
For account lockouts and authentication failures, correlate Netlogon timestamps with Security event logs on domain controllers, especially events such as 4625, 4771, 4776, and 4740. Netlogon can help identify which workstation or service is repeatedly submitting bad credentials, while the Security log provides the account name, failure code, and authentication package. Always narrow the capture window as much as possible; a busy domain controller can produce large logs quickly, and focused timestamps make analysis faster and safer.
How to Disable Netlogon Logging Safely
After you have captured the authentication, secure channel, or domain controller discovery failure you were investigating, turn Netlogon debug logging back off. Netlogon logging is diagnostic rather than operational logging; leaving it enabled can generate large text files, consume disk space on busy domain controllers, and make later troubleshooting harder because old and new events are mixed together. Disabling it does not stop the Netlogon service or affect normal domain authentication.
Use an elevated Command Prompt or PowerShell session on the computer where logging was enabled. To disable Netlogon debug logging with the built-in nltest command, run:
Best Value
- Advanced 6-Step Filtration Technology: Discover the impressive power of the Tastepure RV water filter’s Hex-Flow Technology and its 6-step filtration process. Each layer seamlessly works together to deliver water that’s exceptionally clean.
- Certified Lead-Free: This camping water filter is independently tested & listed to standards NSF/ANSI 42 & NSF/ANSI 53. It’s CSA lead-free content certified to NSF/ANSI 372 & compliant with all federal & state-level lead-free laws.
- Access to Pure, Great-Tasting Water: Enjoy clean water anywhere! This RV inline filter reduces bad tastes, odor, chlorine, sediment, etc. GAC filtration, combined with KDF controls bacteria & mold growth when the outdoor water filter isn’t in use.
- Patented Technology & Made in the USA: This in-line water filter is proudly made in the USA with top-notch materials and expert craftsmanship. The patented design has undergone rigorous testing and quality control to meet the highest standards.
- Versatile Applications: Easily attach this multi-purpose hose water filter to any standard garden or drinking water hose to receive cleaner drinking water. It’s great for campers, boats, pets, gardening, car washes, car detailing, & more.
nltest /dbflag:0x0
This command resets the Netlogon debug flag to zero. On most supported Windows versions, the change takes effect immediately and does not require a restart. If you previously enabled logging by setting the registry value directly, confirm that the debug flag has been cleared under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters. The relevant value is commonly named DBFlag. If it remains set to a verbose value such as 0x2080ffff, set it to 0 or remove the value according to your organization’s change control practices.
Verify that logging has stopped
After disabling logging, verify that the Netlogon log is no longer growing. The standard log path is %windir%\debug\netlogon.log, and the rollover file is typically %windir%\debug\netlogon.bak. Check the modified timestamp and file size before and after a few minutes of normal activity. On a busy domain controller, the file should stop rapidly increasing once debug logging is disabled. If it continues to grow, rerun the command from an elevated prompt and check whether a startup script, Group Policy preference, configuration management tool, or troubleshooting script is reapplying the registry setting.
- Disable command: nltest /dbflag:0x0
- Primary log: %windir%\debug\netlogon.log
- Rollover log: %windir%\debug\netlogon.bak
- Registry location: HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
- Registry value: DBFlag
Archive or remove old logs
Before deleting the files, save a copy if the investigation is still open or the data must be attached to a support case. Compressing the logs into a ZIP file is usually effective because Netlogon logs are plain text. Include the computer name, role, date, time zone, and a short description of the captured issue in the archive name, such as DC01-netlogon-secure-channel-failure-2026-05-25.zip. If the logs contain usernames, domain names, workstation names, site names, or IP addresses, store and transfer them using approved internal methods.
Once the data is no longer needed, delete or rotate the old netlogon.log and netlogon.bak files to reclaim disk space. If Windows reports that the file is in use, disabling logging first and waiting briefly is usually enough; otherwise, restart the Netlogon service only during an approved maintenance window, especially on a domain controller. A service restart can briefly affect domain-related operations on that server, so avoid using it as the first option in production.
Post-change checks
Complete the cleanup by documenting when logging was disabled, which command was used, and where the captured files were stored. If logging was enabled on mulle domain controllers or member servers, disable it on each system individually; the setting is local to the machine. Finally, confirm that the original symptom has either been resolved or that enough evidence was collected to continue analysis through related logs such as Security, System, Group Policy Operational, DNS Client, or Directory Service logs.
Frequently Asked Questions
Do I need to restart the Netlogon service after enabling debug logging?
No, you usually do not need to restart the Netlogon service when enabling logging with nltest /dbflag:0x2080ffff. The setting takes effect immediately, and entries should begin appearing in %windir%\debug\netlogon.log. If the log does not update, confirm you opened the command prompt as an administrator and that the Netlogon service is running.
Where is the Netlogon log stored on Windows clients and domain controllers?
The main log file is stored at C:\Windows\debug\netlogon.log on both Windows clients and domain controllers. When the file grows, Windows may rotate it into netlogon.bak in the same folder. If you are collecting logs for a support case, copy both files before disabling logging or reproducing the issue again.
Which Netlogon log entries should I look for when troubleshooting domain controller discovery?
Look for entries that mention DsGetDcName, DC Locator, site names, domain names, and the domain controller that was selected. These lines can show whether the client is finding a domain controller in the correct Active Directory site or falling back to another site. If you see repeated failures, compare the timestamps with DNS events and verify SRV records, subnet-to-site mappings, and network connectivity to the listed domain controllers.
How can Netlogon logging help diagnose secure channel or trust relationship errors?
Netlogon logging can show failed secure channel operations between a workstation, member server, or domain controller and the domain. Look for status codes such as 0xC000018B, 0xC000006D, or messages involving password set, authentication, or trust validation. If the secure channel is broken, you may need to test with nltest /sc_verify:domainname and repair it using tools such as Test-ComputerSecureChannel or by rejoining the domain.
How do I turn off Netlogon debug logging after troubleshooting?
Run nltest /dbflag:0x0 from an elevated command prompt to disable Netlogon debug logging. Leaving it enabled can generate large log files and add unnecessary noise during future troubleshooting. After disabling it, archive or delete old netlogon.log and netlogon.bak files if you no longer need them.
Bottom Line
Netlogon logging is a practical way to see what is happening during domain authentication, secure channel communication, and domain controller discovery. Enable it only while troubleshooting, reproduce the issue, then review the Netlogon.log and Netlogon.bak files for errors, failed DC lookups, trust problems, DNS issues, or secure channel failures.
After collecting what you need, disable logging to avoid unnecessary disk usage and noise. If the log points to repeated authentication failures, DC location problems, or broken trust relationships, use those findings to focus your next steps on DNS, time sync, network connectivity, domain controller health, or machine account repair.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
