SOC Event Lookup
Event ID 5827NetlogonP2

Windows Event ID 5827: Netlogon denied a vulnerable secure channel connection (machine)

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Netlogon Event ID 5827 records that a domain controller denied a vulnerable Netlogon secure channel connection from a machine account.

Technical Metadata

Technical metadata for Event ID 5827
Event ID5827
ProviderNETLOGON
ChannelSystem
LevelError
MITRE ATT&CKTA0008 Lateral Movement / T1210 Exploitation of Remote Services
Key fields to watchMachine SamAccountName, Domain / Account Type, Machine Operating System / Build / Service Pack

Trigger Scenarios

Microsoft documents this event for CVE-2020-1472 Netlogon secure channel enforcement when a vulnerable machine-account connection is denied.

Key Fields

Machine SamAccountName

The machine account whose vulnerable secure channel connection was denied.

Domain / Account Type

Identifies the domain context and account category for the denied Netlogon connection.

Machine Operating System / Build / Service Pack

Version fields provided in the Microsoft event message and used to verify whether the client is patched or a non-compliant device.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 5827
SecurityEvent
| where EventID == 5827
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 5827
index=wineventlog source="WinEventLog:Security" EventCode=5827
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 5827
dataset = microsoft_windows_raw
| filter edr_event_id = 5827
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security or applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5827
title: Windows Security Event ID 5827
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5827
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID5827A vulnerable Netlogon secure-channel connection from a machine account was denied.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
Account TypeMachine AccountDistinguishes the denied endpoint machine-account connection from a trust-account event.Use Account Type together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1210Exploitation of Remote Services

Detection Notes

Use threshold=1 denied vulnerable machine account connection on a domain controller. Microsoft documents Event 5827 as a denied vulnerable Netlogon secure channel connection from a machine account during CVE-2020-1472 enforcement; that condition is relevant to T1210 Exploitation of Remote Services because Zerologon abuses Netlogon secure channel behavior. Triage Machine SamAccountName, Domain, Account Type, Machine Operating System Build, and any corresponding 5830 allow-list events before deciding whether this is exploitation or an unpatched device.

Common False Positives

  • Unpatched or third-party Netlogon clients can trigger denials after enforcement without being active exploitation.
  • Legacy appliances may require vendor remediation and temporary allow-list review, but the vulnerable state is real.

Related Events

Sample Log

Sanitized event sample
EventID: 5827
Machine SamAccountName: LEGACY-NAS$
Domain: CORP
Account Type: Workstation Trust
Machine Operating System Build: 7601

Frequently Asked Questions

What does Windows Event ID 5827 mean?

A domain controller denied a vulnerable Netlogon secure-channel connection from a machine account.

Does Event ID 5827 always indicate malicious activity?

No. It commonly identifies an unpatched or incompatible device; exploit activity requires corroborating evidence.

How should Event ID 5827 be investigated?

Identify the machine, operating-system build, domain, source network context, patch state, and related 5830 allow-list events.

Sources