Message

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields

Message

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields

Message

Domain Controller Blocked: NTLM authentication to this domain controller is blocked.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

NTLM authentication within the domain %3 is blocked.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests only to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in this domain as an exception to use NTLM authentication.

Fields

Fields

Message

The DC %1 processed a network NTLM authentication involving an account from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6

Forwarded From:
	Secure Channel Type: %7
	Farside Name: %8
	Farside Domain: %9
	Farside IP: %10

NTLM Security:
	NTLM Version: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	Mic Status: %15
	Flags values: %16
	Flags: %17

Status: %18

For more information, see aka.ms/ntlmlogandblock

Fields

Fields

Message

The DC %1 processed a network NTLM authentication involving an account from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6

Forwarded From:
	Secure Channel Type: %7
	Farside Name: %8
	Farside Domain: %9
	Farside IP: %10

NTLM Security:
	NTLM Version: %11
	Service Binding: %12
	Target Machine: %13
	Target Domain: %14
	Mic Status: %15
	Flags values: %16
	Flags: %17

Status: %18

For more information, see aka.ms/ntlmlogandblock

Fields

Fields

Message

The DC %1 processed a forwarded NTLM authentication request originating from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6
	Server IP: %7
	Server OS: %8

NTLM Security:
	NTLM Version: %9
	Service Binding: %10
	Target Machine: %11
	Target Domain: %12
	Mic Status: %13
	Flags values: %14
	Flags: %15

Status: %16
Status Message: %17

For more information, see aka.ms/ntlmlogandblock

Fields

Fields

Message

The DC %1 processed a forwarded NTLM authentication request originating from this domain.

Client Information:
	Client Name: %2
	Client Domain: %3
	Client Machine: %4

Server Information:
	Server Name: %5
	Server Domain: %6
	Server IP: %7
	Server OS: %8

NTLM Security:
	NTLM Version: %9
	Service Binding: %10
	Target Machine: %11
	Target Domain: %12
	Mic Status: %13
	Flags values: %14
	Flags: %15

Status: %16
Status Message: %17

For more information, see aka.ms/ntlmlogandblock

Fields

Message

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields

Message

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields

Message

Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller.
Secure Channel name: %1
User name: %2
Domain name: %3
Workstation name: %4
Secure Channel type: %5

Audit NTLM authentication requests within the domain %3 that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to any of the Deny options.

If you want to allow NTLM authentication requests in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Disabled.

If you want to allow NTLM authentication requests to specific servers in the domain %3, set the security policy Network Security: Restrict NTLM: NTLM authentication in this domain to Deny for domain servers or Deny domain accounts to domain servers, and then set the security policy Network Security: Restrict NTLM: Add server exceptions in this domain to define a list of servers in the domain %3 to which clients are allowed to use NTLM authentication.

Fields

Message

Netlogon failed to retrieve the password for account %1 in domain %2. %3

Fields

Message

The account %1 cannot be used as managed service account on the local machine because not all the supported encryption types of the account are supported by the local machine.

Fields

Message

Netlogon failed to add %1 as a managed service account to this local machine. %2

Fields

Message

Netlogon failed to remove the managed service account %1 from this local machine. %2

Fields

Message

A total of %1 DC locator queries were rejected since the last reported event because they would have exceeded the configured maximum on concurrent network discovery operations.

Fields

Message

Secure channel setup has failed with Kerberos: %1. Falling back to Netlogon.

Fields

Message

Secure channel setup has failed : %1. Protocol used: %2.

Fields

Message

Netlogon is currently configured to allow mailslot messages to be used when locating domain controllers. This mode is unsecure and will be deprecated and removed in a future release.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon is currently configured to listen for mailslot messages sent by clients during a domain controller location operation. This mode is unsecure and will be deprecated and removed in a future release.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon was unable to find the domain name '%1' using any of the known domain name mapping sources. This may cause failures to locate domain controllers in that domain.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Fields

Message

Netlogon discovered a DC using the Netbios protocol. This mode is unsecure and will be deprecated and removed in a future release.

DNS domain name:%1
Netbios domain name:%2

DC:%3


See https://aka.ms/dclocatornetbiosdeprecation for more information.

Fields

Message

Netlogon successfully downloaded the latest administrator-configured domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon failed to download the latest administrator-configured domain name mappings.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon successfully downloaded the latest trusted-domain-based domain name mappings. Run 'nltest.exe /list_dclocmappings' to view the data.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon failed to download the latest trusted-domain-based domain name mappings.

See https://aka.ms/dclocatornetbiosdeprecation for more information.

Message

Netlogon denied an RPC call. The policy is in enforce mode.

Client Information:
	Method name: %1
	Method opnum: %2
	Client address: %3
	Client identity: %4

For more information, see https://aka.ms/dclocatorrpcpolicy

Fields

Message

Netlogon allowed an RPC call that normally would have been denied. The policy is in audit mode.

Client Information:
	Method name: %1
	Method opnum: %2
	Client address: %3
	Client identity: %4

For more information, see https://aka.ms/dclocatorrpcpolicy

Fields