asked on

Event ID 5810 NETLOGON

Hello, I recently upgraded all of my domain controllers to 2008r2 and now I'm noticing the attached event ID being generated in their event logs. This message was never generated prior to the upgrade, and I'm not really sure how to proceed with it. I cannot find any KB articles on it. I haven't raised the forest level to 2008 yet.

During the past 4.18 hours, this domain controller has received 24 connections from dual-stack IPv4/IPv6 clients with partial subnet-site mappings. A client has a partial subnet-site mapping if its IPv4 address is mapped to a site but its global IPv6 address is not mapped to a site, or vice versa. To ensure correct behavior for applications running on member computers and servers that rely on subnet-site mappings, dual-stack IPv4/IPv6 clients must have both IPv4 and global IPv6 addresses mapped to the same site. If a partially mapped client attempts to connect to this domain controller using its unmapped IP address, its mapped address is used for the client's site mapping.  

The log files %SystemRoot%\debug\netlogon.log or %SystemRoot%\debug\netlogon.bak contain the name, unmapped IP address and mapped IP address for each partially mapped client. The log files may also contain unrelated debugging information. To locate the information pertaining to partial-subnet mappings, search for lines that contain the text 'PARTIAL_CLIENT_SITE_MAPPING:'. The first word after this text is the client name. Following the client name is the client's unmapped IP address (the IP address that does not have a subnet-site mapping) and the client's mapped IP address, which was used to return site information.  

USER ACTION  
Use the Active Directory Sites and Services management console (MMC) snap-in to add the subnet mapping for the unmapped IP addresses to the same site being used by the mapped IP addresses. When adding site mappings for IPv6 addresses, you should use global IPv6 addresses and not for instance temporary, link-local or site-local IPv6 addresses.  

The default maximum size of the log files is 20000000 bytes. The current maximum size is 20000000 bytes. To set a different maximum size, create the following registry DWORD value to specify the maximum size in bytes:  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LogFileMaxSize

Open in new window

Mike Kline

Does the 2008 box have IP4 and IP6 enabled? Do you have a subnet identified for both in sites and services?

Thanks

Mike

jmchristy

ASKER

mkline,

Yes, ipv4 and ipv6 are enable in the network connections of the DC's LAN. I'm not sure that I do. Where do I go in S&S to check for subnets?

jmchristy

ASKER

I don't believe I have a subnet for ipv6. I right-clicked Default-First-Site-Name and under the General properties I see my ipv4 subnet, but nothing else. Do I need to add something for ipv6? I didn't specify any settings on the ipv6 LAN settings of the DCs. They are just set to Automatically obtain.

Mike Kline

You could disable IPv6 if you are not using it on your internal network.

You could give it an address and add the IPV6 subnet but if you are like most of us and not using IPv6 then you don't need it. (they are only DCs and not exchange servers right)

Thanks

Mike

jmchristy

ASKER

Okay. I disable IPv6 by just un-checking it on the LAN of the DCs, right? I just read a few articles that said you should leave it enabled, I have no idea why though. We don't run it in our company. No, none of the PCs are exchange servers. We do have an exchange 07 server, but IPv6 is unchecked on it's LAN settings.

ASKER CERTIFIED SOLUTION

Mike Kline

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jmchristy

ASKER

Thanks Mike,

Just out of curiosity, how would I add an IPv6 subnet to my S&S for future reference?

Mike Kline

in sites and services you can right click on subnets and create new subnets. I've never actually tried in production. We are not using IPv6 either...and we probably won't be internally anytime soon.

Thanks

Mike

jmchristy

ASKER

Okay. Thanks again, Mike.