| Event Id | 5807 |
| Source | NETLOGON |
| Description | During the past number hours there have been number connections to this Domain Controller from client machines whose IP addresses dont map to any of the existing sites in the enterprise. Those clients, therefore, have undefined sites and may connect to any Domain Controller including those that are in far distant locations from the clients. A clients site is determined by the mapping of its subnet to one of the existing sites. To move the above clients to one of the sites, please consider creating subnet object(s) covering the above IP addresses with mapping to one of the existing sites. The names and IP addresses of the clients in question have been logged on this computer in the following log file SystemRoot\debug\netlogon.log and, potentially, in the log file SystemRoot\debug\netlogon.bak created if the former log becomes full. The log(s) may contain additional unrelated debugging information. To filter out the needed information, please search for lines which contain text NO_CLIENT_SITE:. The first word after this string is the client name and the second word is the client IP address. The maximum size of the log(s) is controlled by the following registry DWORD valueHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LogFileMaxSize; the default is 20000000 bytes. The current maximum size is 20000000 bytes. To set a different maximum size, create the above registry value and set the desired maximum size in bytes. |
| Event Information | According to Microsoft: CAUSE: This issue may occur if the following conditions are true: 1. The IP address of the client computer is not defined. 2. The IP address of the client computer is not mapped to an existing site in the Subnets folder of the Active Directory Sites and Services snap-in on the local domain controller. RESOLUTION: To resolve this issue, define the IP address of the client computer in the Subnets folder, and then map the IP address to the site that contains the local domain controller. To do this, follow these steps: 1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services. 2. In the left pane, locate and then click the Sites\Subnets folder. 3. Right-click Subnets, and then click New Subnet. 4. In the Address box, type the IP address of the client. 5. In the Mask box, type the subnet mask of the client. 6. In the Site Name list, click the site object that you want to join the client to, and then click OK. When you select a site object, you have to select the site object that contains the local domain controller. 7. On the File menu, click Exit to close Active Directory Sites and Services. |
| Reference Links | You may receive event ID 5807 on a Windows Server 2003-based domain controller NETLOGON Event ID 5807 is recorded on a Windows Server 2003 domain controller |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.