Server 2003 Event viewer Netlogon5807 doesn't register in netlogon.log

Win server 2003 Event Viewer registers warning Netlogon 5807 alert, however the above event can not be found in netlogon.log. The time stamp for the warning in Event Viewer falls in between time stamps found in netlogon.log. thus we don't have any IP of client machine in different subnet trying to access AD. Any advise to investigate the cause(s) of the Netlogon alert event would be appreciated.

You can give a try to below mentioned steps and I am hoping that it will be useful to fix the matter of yours.

• Click on Start and go for Programs and go for Administrative Tools and click on Active Directory Sites and Services.
• You have to click on Sites\Subnets and right click on Subnets and click on New Subnet.
• Into the Address box and enter IP address of Client.
• Now go for Mask Box and enter subnet mask of client.
• Into Site Name list and click on site object which you wanted to join the client to and after that click on Ok button.
• Now click on Exit from File menu.

The problem is that we do not know, which clients IP(s), who's subnets is not configured in AD wants o reach AD. Is this an intruder, if so how can the intruder access AD, when they are in a different subnet. How can we find the aboves IP(s)? Thanks for the steps.

Why isn't the event, IP and subnet of the client that triggers the NETLOGON ID 5807 in Event Viewer recorded in 'SystemRoot\debug\netlogon.log' ?

Actually, this issue may occur if the following conditions are true:

• The IP address of the client computer is not defined.
• The IP address of the client computer is not mapped to an existing site in the Subnets folder of the Active Directory Sites and Services snap-in on the local domain controller.

Try to clear it:

C:\> net stop netlogon

C:\>del netlogon.log *OR EVEN BETTER* ren netlogon.log netlogon071408.txt

C:\> net start netlogon