Event ID 5807: During the past … hours there have been … connections to this Domain
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
During the past … hours there have been … connections to this Domain
Event 5807
NETLOGON
System log
Message and fields (as Event Viewer shows them)
During the past … hours there have been … connections to this Domain
Controller from client machines whose IP addresses don't map to any of
the existing sites in the enterprise. Those clients, therefore, have
undefined sites and may connect to any Domain Controller including
those that are in far distant locations from the clients. A client's site
is determined by the mapping of its subnet to one of the existing sites.
To move the above clients to one of the sites, please consider creating
subnet object(s) covering the above IP addresses with mapping to one of the
existing sites. The names and IP addresses of the clients in question have
been logged on this computer in the following log file
'%SystemRoot%\debug
etlogon.log' and, potentially, in the log file
'%SystemRoot%\debug
etlogon.bak' created if the former log becomes full.
The log(s) may contain additional unrelated debugging information. To filter
out the needed information, please search for lines which contain text
'NO_CLIENT_SITE:'. The first word after this string is the client name and
the second word is the client IP address. The maximum size of the log(s) is
controlled by the following registry DWORD value
'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LogFileMaxSize';
the default is … bytes. The current maximum size is … bytes. To set a
different maximum size, create the above registry value and set the desired
maximum size in bytes.