Windows log files

The Task Scheduler service uses a log file, SchedLgU.txt. The location of this file is specified in the LogPath registry value:

Key: HKLM\SOFTWARE\Microsoft\SchedulingAgent
Value: LogPath (REG_SZ)
Default value: %SystemRoot%\SchedLgU.txt (W2K, WXP), %SystemRoot\Tasks\SchedLgU.txt (W2K3)

The PolicyAgent service supports logging in a file named oakley.log, empty by default. To enable logging, the following registry value must be set to 1:

Key: HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley
Value: EnableLogging (REG_DWORD)

The IPSEC Services services (Windows 2000) also recognizes the following registry value, which, when set to 1, supports additional logging in a ipsecpa.log file:

Key: HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent
Value: Debug (REG_DWORD)

The DNS Client service does not log by default. However, if a file named %systemroot%\system32\dnsrslvr.log is manually created, this file is used by the service to log debug information:

C:\WINDOWS\system32\>echo "" > dnsrslvr.log

In Windows XP and Windows Server 2003, NTFS write permissions for the NETWORK SERVICE SID must be explictly given:

C:\WINDOWS\system32\>cacls dnsrslvr.log /E /G "NETWORK SERVICE":W

A file named %systemroot%\system32\asyncreg.log can be manually created to enable logging of dnsapi functions:

C:\WINDOWS\system32\>echo "" > asyncreg.log

In Windows XP and Windows Server 2003, NTFS write permissions for the NETWORK SERVICE SID must be explictly given:

C:\WINDOWS\system32\>cacls asyncreg.log /E /G "NETWORK SERVICE":W

As documented in the #816043 Microsoft knowledge base article, the Windows Time service supports logging in a text file. The FileLogName registry value must be explictly added:

Key: HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config
Value: FileLogName (REG_SZ)

The dcpromo.exe program is used to promote or demote an Active Directory domain controller. When dcpromo is used, log files are generated.

When the SamLogLevel registry value is present and set to 1, the SAM creates a sam.log file:

Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: SamLogLevel (REG_DWORD)

The sam.log file is used to log account lockout related events.

In Windows Server 2003, both the Kerberos authentication package and KDC service can be configured to log debug information, in a file named lsass.log.

To enabled logging in a file, the LogToFile registry value must be set to 1:

Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value: LogToFile (REG_DWORD)
Content: 1 (to enable logging)

Then, the KerbDebugLevel registry value must be added and configured to specify what kind of Kerberos events must be logged:

Key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value: KerbDebugLevel (REG_DWORD)

The following list gives the common debug values that must be used to build a binary mask specified in KerbDebugLevel:

Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000

In the Troubleshooting Kerberos errors document, Microsoft recommends to set the KerbDebugLevel value to 0xc0000043 for typical debugging work.

In Windows Server 2003, the KDC service can also be configured to log debugging information, by adding the KdcDebugLevel registry value:

Key: HKLM\SYSTEM\CurrentControlSet\Services\Kdc
Value: KdcDebugLevel (REG_DWORD)

Errors: 0x00000001
Warnings: 0x00000002
Tracing: 0x00000004
API tracing: 0x00000008
Credential related tracing: 0x00000010
Security Context tracing: 0x00000020
Logon Session tracing: 0x00000040
Logon tracing: 0x00000100
KDC tracing: 0x00000200
Detailed Security Context tracing: 0x00000400
Time related tracing: 0x00000800
User related tracing: 0x00001000
Leak related tracing: 0x00002000
WinSock related tracing: 0x00004000
SPN cache tracing: 0x00008000
S4U Errors: 0x00010000
S4U tracing: 0x00020000
Loopback tracing: 0x00080000
Ticket renewal tracing: 0x00100000
User to User tracing: 0x00200000
Locks tracing: 0x01000000
Use Extended Errors: 0x10000000

The KdcExtraLogLevel registry value can be added for extra KDC logging:

Key: HKLM\SYSTEM\CurrentControlSet\Services\Kdc
Value: KdcExtraLogLevel (REG_DWORD)
Default value: 0x2

The following extra log levels are defined:

Audit SPN unknown errors: 0x1
Log detailed PKINIT1 errors: 0x2
Log all KDC errors with KLIN information: 0x4

The Netlogon service can be configured to log debugging information to a log file, named netlogon.log.

As documented in the #109626, the DbFlag registry value can be added and set to a binary mask (typically, 0x2080FFFF for Windows 2000 and Windows Server 2003):

Key: HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Value: DbFlag (REG_DWORD)