---
title: "Netlogon Log Parsing with PowerShell: A Deep Dive"
description: "Uncover valuable troubleshooting info by parsing the netlogon log file with PowerShell."
canonical: "https://adamtheautomator.com/netlogon-log/"
---

# Netlogon Log Parsing with PowerShell: A Deep Dive

> Uncover valuable troubleshooting info by parsing the netlogon log file with PowerShell.

Source: https://adamtheautomator.com/netlogon-log/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Netlogon Log Parsing with PowerShell: A Deep Dive](https://adamtheautomator.com/wp-content/uploads/2019/08/question-mark-1872665_1920.jpg)

# Netlogon Log Parsing with PowerShell: A Deep Dive

[![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)11 August 20193 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/)

Table of Contents

*   [Searching the netlogon log File](#search-the-netlogon-log-file)
*   [Enumerating all DCs in a Forest](#enumerating-all-dcs-in-a-forest)
*   [Automating Text File Searching on a DC](#automating-text-file-searching-on-a-dc)
*   [Expanding the netlogon log Search to all DCs](#expanding-to-all-dcs)
*   [Summary](#summary)

The netlogon log file exists on all [Active Directory](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) domain controllers and contains a wealth of information. But, how it records information is a mess.

In this post, you’re going to learn how to use PowerShell to read and parse the netlogon log file by solving a real problem; tracking down roaming clients.

As long as AD has been around, there have been roaming clients. Roaming clients are those domain-joined machines that aren’t assigned to an AD site. These computers don’t have an Active Directory subnet defined to a site. They have no way to know what site they’re in.

These computers are problematic because they randomly choose a domain controller to authenticate to. Authentication requests could take much longer than expected if the client decides to select a domain controller (DC) across the globe.

It’s important to recognize these roaming clients and to remediate them whenever possible.

## Searching the netlogon log File

The process of hunting down these clients is pretty simple. You need to query a log file on each domain controller in your AD forest. This log file contains lines with the string _NO\_CLIENT\_SITE_ in them. You can be sure if you see an instance of this line you’ve got a client that’s gone roaming.

You could check this log file yourself across your DCs, but that’s not too fun. Let’s automate this task with PowerShell!

You’re looking for for a log file called _netlogon.log_ on each DC. If any clients start roaming, the DC that they authenticate to will record that activity in this file. This file is located in the _C:\\Windows\\Debug_ folder of each domain controller. This file is where we’ll look for that _NO\_CLIENT\_SITE_ reference.

## Enumerating all DCs in a Forest

To account for all clients across the domain, you’ll need to find all DCs in the forest. To do that, use both the `Get-ADForest` and `Get-AdDomainController` PowerShell cmdlets.

`Get-AdForest` returns a property called `Domains` that will show all domains in the forest. Once you have all the domains in the forest, you can then find all domain controllers in each of those domains with `Get-ADDomainController`.

```powershell
$dcs = ((Get-ADForest).Domains | foreach {(Get-ADDomainController-Server $_ -Filter *) }).HostName
```

In the above example, I’m only outputting the `HostName`, which is the FQDN of each domain controller.

## Automating Text File Searching on a DC

Now that you have all the DCs in the forest, you’ll need to develop some code to query each of them. As good practice, I always prepare the code against one first. Once you have this, it’s easy to expand to all domain controllers.

One way to find search text files with PowerShell is to use the [`Select-String`](https://adamtheautomator.com/powershell-grep/) cmdlet. `Select-String` is a cmdlet that allows you to specify a regular expression as a pattern to search for. `Select-String` can search for patterns inside of a string or a file with the `Path` parameter.

In the example below, I’m searching for all lines in the netlogon log (_netlogon.log)_ file with the string _NO\_CLIENT\_SITE_ that look like this:

`12/25 19:36:41 CHILD: NO_CLIENT_SITE: MYCLIENT 192.168.0.10`

If there’s a match, pull the name (MYCLIENT) out of that line. To do that, use the regular expression `NO_CLIENT_SITE: (.*) \d`. Then, pass that regular expression and the path to the _netlogon.log_ file to `Select-String`.

```powershell
Select-String -Pattern 'NO_CLIENT_SITE: (.*) \d' -Path "\\MYDOMAINCONTROLLER\c$\windows\debug\netlogon.log"
```

This output is great, but I only want to see client names. To do this, look at each of the objects that `Select-String` outputs. Then find the value that came from that regular expression we used.

That value can be found buried inside of the second `Groups` object inside of the `Matches` property for each line that was matched.

```powershell
$_.Matches.Groups[1].Value
```

You now have code that looks something like this:

```powershell
Select-String -Pattern 'NO_CLIENT_SITE: (.*) \d' -Path '\\MYDOMAINCONTROLLER\c$\windows\debug\netlogon.log' | foreach {
    $_.Matches.Groups[1].Value
}
```

You’re still not done, however. You’ll find that if a client has been roaming for a while, it will be recorded in the log many times.

To remove all the duplicates, pipe the objects from `Select-String` to the [`Group-Object`](https://adamtheautomator.com/powershell-group-object/) cmdlet. This process will remove all duplicates and give you a way to find unique client names.

```powershell
Select-String -Pattern 'NO_CLIENT_SITE: (.*) \d' -Path '\\MYDOMAINCONTROLLER\c$\windows\debug\netlogon.log' | foreach {
    $_.Matches.Groups[1].Value
} | Group-Object
```

The final step is to output only the client names from the output of `Group-Object`.

```powershell
$clients = Select-String -Pattern 'NO_CLIENT_SITE: (.*) \d' -Path '\\MYDOMAINCONTROLLER\c$\windows\debug\netlogon.log' | foreach {
    $_.Matches.Groups[1].Value
} | Group-Object

$clients | foreach {
    $_.Name
}
```

## Expanding the netlogon log Search to all DCs

You now have the code to do a single DC. Querying all DCs, at this point, is a piece of cake with a _foreach_ loop.

Below is the whole code block you can use.

```powershell
$dcs = ((Get-ADForest).Domains | foreach { (Get-ADDomainController -Server $_ -Filter *) }).HostName

foreach ($d in $dcs) {
    $output = @{'DomainController' = $d}
    $clients = Select-String -Pattern 'NO_CLIENT_SITE: (.*) \d' -Path "\\$d\c`$\windows\debug\netlogon.log" | foreach {
        $_.Matches.Groups[1].Value
    } | Group-Object

    if ($clients) {
        $clients | foreach {
            $output.Client = $_.Name
            [pscustomobject]$output
        }
    }
}
```

## Summary

With a little knowledge of where roaming clients can be found in and some PowerShell, you can knock out this problem quickly. Build a script that will query each _netlogon.log_ file in the entire domain, sit back and see how bad the problem is. Now actually fixing those issues is up to you!

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fnetlogon-log%2F&text=Netlogon%20Log%20Parsing%20with%20PowerShell%3A%20A%20Deep%20Dive)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fnetlogon-log%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fnetlogon-log%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png)

### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/)

Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world

![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png)

### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/)

Find the ntds.dit location and monitor your Active Directory database using PowerShell.

![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png)

### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/)

See what we can do to find locked out users in Active Directory with PowerShell!

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)