Netlogon Service is one of the key LSA (Local Security Authority) processes that run on every Domain Controller. Netlogon service log files are useful when you troublehsoot authentication problems, client account logon, lockout etc. By default the netlogon service logging is not enabled. You can do it in 2 ways to enable netlogon logging.
1. nltest /dbflag:0x2080ffff
- Restart netlogon service
- Logging will happen at %windir%\debug\netlogon
Note: Nltest is part of Win 2008 and also support tools for Win 2003, 2000 and XP
Note: Run nltest /dbflag:0×0 to disable logging
OR
2. Start Regedt32
- go to HKLM\system\Currentcontrolset\Services\Netlogon\Parameters
- Create a new REG_DWORD called DBFlag and add 2080ffff hexadecimal value
- Restart netlogon service
Note: To disable it, change the value to 0×0
One of the issues with netlogon.log file is the file size will grow quickly. By default the Max log file size is 20MB. You can change this by editing registry.
HKLM\System\Currentcontrolset\Services\Netlogon\Parameters
Value Name: MaximimLogFileSize
Value Data: <Max log file size in Bytes>
Utility used to query the Netlogon log File is nlparse.exe. It is a GUI tool that comes with ALTools.exe file at
http://www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
nlparse contains the most common Netlogon error codes and stores the output in two files – %windir%\debug\netlogon - folders: netlogon.log-out.scv and netlogon.log-summaryout.txt
I still remember those days when I took MCSE-2000 certification in the year 2002. I use to go to an internet cafe and download exam dumps from mcsebraindumps.net site. Then come back home put them in my system and prepare for exams. Those dumps really helped me to pass the exams. After I passed my first paper 70-210 I thought of sharing this to the world and started thinking how I could help others in taking certification.
You know what, then I started collecting all the important questions for all the exams and uploaded them to mcsebraindumps.net site.
Recently I went back to that site and could find one of those dumps which I have uploaded. I felt happy to see my dump available still in the site database.
Here is the link.
http://www.mcsebraindumps.net/dump.php?bd_id=9734
I have a message to all the guys who are taking any certification course. I am sure most of you are seeking help from the internet to prepare, take your certification and forget there itself. Why don’t you take an opportunity to help others by uploading dumps or through some blogs. If you don’t find time to upload or don’t know where to go to provide your helping hand, please write to me with the details.
Presence is more than just being there – Malcolm S. Forbes
Compromise – That’s when everybody loses, but with the idea that everyone should lose equally
Ability is what you’re capable of, Motivation determines what you do, Attitude determines how well you do it
I will try to keep you all posted with interesting stuff, information on different exciting events, exciting things happening in Hyderabad. I bet you will enjoy reading this.
I am a Technical Advisor on Windows Infrastructure currently working for IBM. Prior to this I was working for Microsoft. In MS I was in Data Center Operations and later moved to Active Directory Team. I live in Hyderabad.
