How to check domain users netlogon

Written by Mahidhar Adarsh, IT security team, ManageEngine Updated on July 2026

Netlogon is a Local Security Authority service that runs in the background. It handles authenticating users in to the domain. Executing a few commands within an elevated prompt enables the logging of Netlogon events. After this you can access the Netlogon file to check events and troubleshoot. them. You can also assign a Netlogon file to a particular user or users in an so you can track a user's activity when they login.

Step 1: Create the login script

• In the Domain Controller locate C:\Windows\SYSvol\sysvol\[domain].com\scripts. You can also do this via 'My Computer'. Replace [domain] with the name of the domain your workstations log into.
• Type printmanagement.msc, then press Enter. Print Management will open.

  

• On the File menu, you can create a new folder to maintain all your Netlogon files. In this folder also create a 'New Text Document'.
• Double-click the 'New Text Document' icon to open it in Notepad.
• Enter the any commands as required.
• Click om the 'File' menu, and select 'Save As'. This pulls up the 'Save As' dialog box. Change the 'Save as type' to 'All Files' and save this file with the name user1_logon.bat.
• Exit Notepad and 'My Computer'

Step 2: Assign the login script to a particular domain user

• In your 'Server Manager' go to 'Tools' and click on 'Active Directory Users and Computers'.
• In the 'Active Directory Users and Computers' snap-in, click the Users folder in the Tree pane.
• Select the user you want to add the login script for. Right click and select 'Properties'. In the 'Logon script' text box, type 'user1_logon.bat'. Click 'OK'.
• You can repeat this procedure for every user you want to assign the login script to.

Step 3: Access your Netlogon files and understand common Netlogon codes

• You can view your Netlogon files by entering the following command in the 'Run' Dialog box.

Here Folder name is the name of the folder you created to store your Netlogon files.

• Below is a snippet of the Netlogon log file for a user showing a successful LOGON event.

Here are a few codes you can use to understand the LOGON activity in a user's log file.

Active Directory Auditing just got easier!

ADAudit Plus comes bundled with more than 300 predefined reports that makes your AD auditing easier. The solution also sends real-time alerts for critical events and thereby help you to secure your network from threats and boost your IT security posture. Check out the capabilities of ADAudit Plus here.