Logging with the Netlogon service

The Netlogon service is one of the key Local Security Authority (LSA) processes that run on every Windows domain controller. When you troubleshoot authentication problems, analyzing the Netlogon service log files can be useful. How do I turn Netlogon service logging on and off, and how do I analyze the content of the Netlogon log files?

To turn on Netlogon service logging, type the following Nltest command at the command line:

nltest /dbflag:2080ffff

Enabling Netlogon service logging requires that you restart the Netlogon service. To do so, use the Net Stop Netlogon and Net Start Netlogon commands. To disable netlogon service logging, type:

nltest /dbflag:0

Then, restart the Netlogon service again. The Netlogon service stores log data in a special log file called netlogon.log, in the %Windir%debug folder.

Two utilities are useful in querying the Netlogon log files: Nlparse.exe and Findstr.exe. Nlparse.exe is a GUI tool that comes with Microsoft Account Lockout tools. You can download Account Lockout tools for free from the Microsoft Web site as part of the “Account Lockout and Management Tools” ALTools.exe file at http://www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en. Figure 1 shows the Nlparse GUI, which contains the most common Netlogon error codes and their meaning. Nlparse stores the output of its queries in two files in the %Windir%debug folder: netlogon.log-out.scv and netlogon.log-summaryout.txt.

Findstr.exe is a command-line tool that’s included with the default installation of Windows Server 2003, Windows XP, and Windows 2000. You can use this tool to query one or multiple Netlogon files for occurrences of a particular user account or error code. For example, the following command queries the netlogon.log file for occurrences of user JoeJ and stores the results of the query in the output.txt file:

Findstr ”JoeJ” netlogon.log >c:output.txt