Microsoft-Windows-Security-Netlogon

31 events across 2 channels

Event	Title	Channel	Sample
4004	Domain Controller Blocked: NTLM authentication to this domain controller is …	Operational	N
4005	Domain Controller Blocked: NTLM authentication to this domain controller is …	Operational	N
4006	Domain Controller Blocked: NTLM authentication to this domain controller is …	Operational	N
4030	The DC DCName processed a network NTLM authentication involving an account from …	Operational	N
4030	The DC DCName processed a network NTLM authentication involving an account from …	Operational	N
4031	The DC DCName processed a network NTLM authentication involving an account from …	Operational	N
4031	The DC DCName processed a network NTLM authentication involving an account from …	Operational	N
4032	The DC DCName processed a forwarded NTLM authentication request originating from …	Operational	N
4032	The DC DCName processed a forwarded NTLM authentication request originating from …	Operational	N
4033	The DC DCName processed a forwarded NTLM authentication request originating from …	Operational	N
4033	The DC DCName processed a forwarded NTLM authentication request originating from …	Operational	N
8004	Domain Controller Blocked Audit: Audit NTLM authentication to this domain …	Operational	N
8005	Domain Controller Blocked Audit: Audit NTLM authentication to this domain …	Operational	N
8006	Domain Controller Blocked Audit: Audit NTLM authentication to this domain …	Operational	N
9000	Netlogon failed to retrieve the password for account AccountName in domain …	Operational	Y
9001	The account Account cannot be used as managed service account on the local …	Operational	N
9002	Netlogon failed to add Account as a managed service account to this local …	Operational	N
9003	Netlogon failed to remove the managed service account Account from this local …	Operational	N
9004	A total of RequestsRejected DC locator queries were rejected since the last …	Operational	N
9005	Secure channel setup has failed with Kerberos: Status.	Operational	Y
9006	Secure channel setup has failed : Status.	Operational	N
9007	Netlogon is currently configured to allow mailslot messages to be used when …	Operational	N
9008	Netlogon is currently configured to listen for mailslot messages sent by clients …	Operational	N
9009	Netlogon was unable to find the domain name 'DomainName' using any of the known …	Operational	N
9010	Netlogon discovered a DC using the Netbios protocol.	Operational	N
9011	Netlogon successfully downloaded the latest administrator-configured domain name …	Operational	Y
9012	Netlogon failed to download the latest administrator-configured domain name …	Operational	Y
9013	Netlogon successfully downloaded the latest trusted-domain-based domain name …	Operational	Y
9014	Netlogon failed to download the latest trusted-domain-based domain name …	Operational	Y
9015	Netlogon denied an RPC call.	Operational	N
9016	Netlogon allowed an RPC call that normally would have been denied.	Operational	N

Event ID 4004: Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: BlockingNTLM

Description

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Message #

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 4005: Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: BlockingNTLM

Description

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Message #

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 4006: Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: BlockingNTLM

Description

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.

Message #

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 4030: The DC DCName processed a network NTLM authentication involving an account from this domain.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC DCName processed a network NTLM authentication involving an account from this domain.

Message #

The DC %1 processed a network NTLM authentication involving an account from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6

Forwarded From:
	Secure Channel Type: %7
	Farside Name: %8
	Farside Domain: %9
	Farside IP: %10

NTLM Security:
	NTLM Version: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	Mic Status: %15
	Flags values: %16
	Flags: %17

Status: %18

For more information, see aka.ms/ntlmlogandblock

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ForwarderType` UnicodeString
`ForwarderName` UnicodeString
`ForwarderDomain` UnicodeString
`ForwarderIP` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4030: The DC DCName processed a network NTLM authentication involving an account from this domain

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC processed a network NTLM authentication involving an account from this domain.

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ForwarderType` UnicodeString
`ForwarderName` UnicodeString
`ForwarderDomain` UnicodeString
`ForwarderIP` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4031: The DC DCName processed a network NTLM authentication involving an account from this domain.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC DCName processed a network NTLM authentication involving an account from this domain.

Message #

The DC %1 processed a network NTLM authentication involving an account from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6

Forwarded From:
	Secure Channel Type: %7
	Farside Name: %8
	Farside Domain: %9
	Farside IP: %10

NTLM Security:
	NTLM Version: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	Mic Status: %15
	Flags values: %16
	Flags: %17

Status: %18

For more information, see aka.ms/ntlmlogandblock

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ForwarderType` UnicodeString
`ForwarderName` UnicodeString
`ForwarderDomain` UnicodeString
`ForwarderIP` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4031: The DC DCName processed a network NTLM authentication involving an account from this domain

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC processed a network NTLM authentication involving an account from this domain.

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ForwarderType` UnicodeString
`ForwarderName` UnicodeString
`ForwarderDomain` UnicodeString
`ForwarderIP` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4032: The DC DCName processed a forwarded NTLM authentication request originating from this domain.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC DCName processed a forwarded NTLM authentication request originating from this domain.

Message #

The DC %1 processed a forwarded NTLM authentication request originating from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6
	Server IP: %7
	Server OS: %8

NTLM Security:
	NTLM Version: %9
	Service Binding: %10
	Target Machine: %11
	Target Domain: %12
	Mic Status: %13
	Flags values: %14
	Flags: %15

Status: %16
Status Message: %17

For more information, see aka.ms/ntlmlogandblock

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ServerIP` UnicodeString
`ServerOS` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4032: The DC DCName processed a forwarded NTLM authentication request originating from this domain

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC processed a forwarded NTLM authentication request originating from this domain.

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ServerIP` UnicodeString
`ServerOS` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4033: The DC DCName processed a forwarded NTLM authentication request originating from this domain.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC DCName processed a forwarded NTLM authentication request originating from this domain.

Message #

The DC %1 processed a forwarded NTLM authentication request originating from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6
	Server IP: %7
	Server OS: %8

NTLM Security:
	NTLM Version: %9
	Service Binding: %10
	Target Machine: %11
	Target Domain: %12
	Mic Status: %13
	Flags values: %14
	Flags: %15

Status: %16
Status Message: %17

For more information, see aka.ms/ntlmlogandblock

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ServerIP` UnicodeString
`ServerOS` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 4033: The DC DCName processed a forwarded NTLM authentication request originating from this domain

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

The DC processed a forwarded NTLM authentication request originating from this domain.

Fields #

Name	Description
`DCName` UnicodeString
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`AccountMachine` UnicodeString
`ServerName` UnicodeString
`ServerDomain` UnicodeString
`ServerIP` UnicodeString
`ServerOS` UnicodeString
`NtlmVersion` UnicodeString
`ServiceBinding` UnicodeString
`TargetMachine` UnicodeString
`TargetDomain` UnicodeString
`MicStatus` UnicodeString
`AvFlags` HexInt32
`AvFlagsStr` UnicodeString
`Status` HexInt32	NTSTATUS reference
`StatusMsg` UInt32

Event ID 8004: Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Message #

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 8005: Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Message #

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 8006: Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: AuditingNTLM

Description

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.

Message #

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields #

Name	Description
`SChannelName` UnicodeString
`UserName` UnicodeString
`DomainName` UnicodeString
`WorkstationName` UnicodeString
`SChannelType` UInt32

Event ID 9000: Netlogon failed to retrieve the password for account AccountName in domain AccountDomain.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Error
Task: MSA

Description

Netlogon failed to retrieve the password for account AccountName in domain AccountDomain. Status.

Message #

Netlogon failed to retrieve the password for account %1 in domain %2. %3

Fields #

Name	Description
`AccountName` UnicodeString
`AccountDomain` UnicodeString
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "guid": "E5BA83F6-07D0-46B1-8BC7-7E669A1D31DC",
    "event_source_name": "",
    "event_id": 9000,
    "version": 0,
    "level": 2,
    "task": 3,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:17:37.552321+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 7024
    },
    "channel": "Microsoft-Windows-Security-Netlogon/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "AccountName": ".\\domainadmin",
    "AccountDomain": "NULL",
    "Status": 3221225524
  },
  "message": ""
}

Event ID 9001: The account Account cannot be used as managed service account on the local machine because not all the supported encryption types of the account are sup...

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: MSA

Description

The account Account cannot be used as managed service account on the local machine because not all the supported encryption types of the account are supported by the local machine.

Message #

The account %1 cannot be used as managed service account on the local machine because not all the supported encryption types of the account are supported by the local machine.

Fields #

Name	Description
`Account` UnicodeString

Event ID 9002: Netlogon failed to add Account as a managed service account to this local machine.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: MSA

Description

Netlogon failed to add Account as a managed service account to this local machine. Status.

Message #

Netlogon failed to add %1 as a managed service account to this local machine. %2

Fields #

Name	Description
`Account` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 9003: Netlogon failed to remove the managed service account Account from this local machine.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: MSA

Description

Netlogon failed to remove the managed service account Account from this local machine. Status.

Message #

Netlogon failed to remove the managed service account %1 from this local machine. %2

Fields #

Name	Description
`Account` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 9004: A total of RequestsRejected DC locator queries were rejected since the last reported event because they would have exceeded the configured maximum on concurrent ...

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

A total of RequestsRejected DC locator queries were rejected since the last reported event because they would have exceeded the configured maximum on concurrent network discovery operations.

Message #

A total of %1 DC locator queries were rejected since the last reported event because they would have exceeded the configured maximum on concurrent network discovery operations.

Fields #

Name	Description
`RequestsRejected` UInt32

Event ID 9005: Secure channel setup has failed with Kerberos: Status.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Warning
Task: Securechannelsetup

Description

Secure channel setup has failed with Kerberos: Status. Falling back to Netlogon.

Message #

Secure channel setup has failed with Kerberos: %1. Falling back to Netlogon.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "event_id": 9005,
    "level": 3,
    "task": 5,
    "opcode": 0,
    "time_created": "2026-05-27T16:18:19.3522580+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Security-Netlogon"
  },
  "event_data": {
    "Status": "3221225701"
  }
}

Event ID 9006: Secure channel setup has failed : Status.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: Securechannelsetup

Description

Secure channel setup has failed : Status. Protocol used: Protocol.

Message #

Secure channel setup has failed : %1. Protocol used: %2.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`Protocol` UnicodeString	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP

Event ID 9007: Netlogon is currently configured to allow mailslot messages to be used when locating domain controllers.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon is currently configured to allow mailslot messages to be used when locating domain controllers. This mode is unsecure and will be deprecated and removed in a future release.

Message #

Netlogon is currently configured to allow mailslot messages to be used when locating domain controllers. This mode is unsecure and will be deprecated and removed in a future release.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Event ID 9008: Netlogon is currently configured to listen for mailslot messages sent by clients during a domain controller location operation.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon is currently configured to listen for mailslot messages sent by clients during a domain controller location operation. This mode is unsecure and will be deprecated and removed in a future release. See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message #

Netlogon is currently configured to listen for mailslot messages sent by clients during a domain controller location operation. This mode is unsecure and will be deprecated and removed in a future release.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Event ID 9009: Netlogon was unable to find the domain name 'DomainName' using any of the known domain name mapping sources.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon was unable to find the domain name 'DomainName' using any of the known domain name mapping sources. This may cause failures to locate domain controllers in that domain.

Message #

Netlogon was unable to find the domain name '%1' using any of the known domain name mapping sources. This may cause failures to locate domain controllers in that domain.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Fields #

Name	Description
`DomainName` UnicodeString

Event ID 9010: Netlogon discovered a DC using the Netbios protocol.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon discovered a DC using the Netbios protocol. This mode is unsecure and will be deprecated and removed in a future release.

Message #

Netlogon discovered a DC using the Netbios protocol. This mode is unsecure and will be deprecated and removed in a future release.

DNS domain name:%1
Netbios domain name:%2

DC:%3


See https://aka.ms/dclocatornetbiosdeprecation for more information.

Fields #

Name	Description
`DNSDomainName` UnicodeString
`DomainName` UnicodeString
`DomainController` UnicodeString

Event ID 9011: Netlogon successfully downloaded the latest administrator-configured domain name mappings.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Informational
Task: LOCATOR

Description

Netlogon successfully downloaded the latest administrator-configured domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

Message #

Netlogon successfully downloaded the latest administrator-configured domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "event_id": 9011,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "time_created": "2026-05-27T16:39:09.7356702+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Security-Netlogon"
  },
  "event_data": {}
}

Event ID 9012: Netlogon failed to download the latest administrator-configured domain name mappings.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Warning
Task: LOCATOR

Description

Netlogon failed to download the latest administrator-configured domain name mappings.

Message #

Netlogon failed to download the latest administrator-configured domain name mappings.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "event_id": 9012,
    "level": 3,
    "task": 4,
    "opcode": 0,
    "time_created": "2026-04-28T02:33:43.2316720+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Security-Netlogon"
  },
  "event_data": {}
}

Event ID 9013: Netlogon successfully downloaded the latest trusted-domain-based domain name mappings.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Informational
Task: LOCATOR

Description

Netlogon successfully downloaded the latest trusted-domain-based domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

Message #

Netlogon successfully downloaded the latest trusted-domain-based domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "event_id": 9013,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "time_created": "2026-05-27T16:39:09.8609039+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Security-Netlogon"
  },
  "event_data": {}
}

Event ID 9014: Netlogon failed to download the latest trusted-domain-based domain name mappings.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Level: Warning
Task: LOCATOR

Description

Netlogon failed to download the latest trusted-domain-based domain name mappings.

Message #

Netlogon failed to download the latest trusted-domain-based domain name mappings.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Netlogon",
    "event_id": 9014,
    "level": 3,
    "task": 4,
    "opcode": 0,
    "time_created": "2026-04-28T02:33:43.2346256+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Security-Netlogon"
  },
  "event_data": {}
}

Event ID 9015: Netlogon denied an RPC call.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon denied an RPC call. The policy is in enforce mode.

Message #

Netlogon denied an RPC call. The policy is in enforce mode.

Client Information:
	Method name: %1
	Method opnum: %2
	Client address: %3
	Client identity: %4

For more information, see https://aka.ms/dclocatorrpcpolicy

Fields #

Name	Description
`MethodName` AnsiString
`MethodOpnum` UInt32
`ClientAddress` UnicodeString
`ClientSid` SID

Event ID 9016: Netlogon allowed an RPC call that normally would have been denied.

Provider: Microsoft-Windows-Security-Netlogon
Channel: Operational
Task: LOCATOR

Description

Netlogon allowed an RPC call that normally would have been denied. The policy is in audit mode.

Message #

Netlogon allowed an RPC call that normally would have been denied. The policy is in audit mode.

Client Information:
	Method name: %1
	Method opnum: %2
	Client address: %3
	Client identity: %4

For more information, see https://aka.ms/dclocatorrpcpolicy

Fields #

Name	Description
`MethodName` AnsiString
`MethodOpnum` UInt32
`ClientAddress` UnicodeString
`ClientSid` SID

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e5ba83f6-07d0-46b1-8bc7-7e669a1d31dc

Defined in netlogon.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4050, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4946, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)