Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Hundreds of Audit Failure Event 4776 logged by unknown users

$
0
0

Hi,

My DC is reporting thousand of Event ID 4776 every 30seconds.

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Logon Account: sales  (This can be admin, administrator, john, mary, etc.)

Source Workstation: DC

Error Code: 0xc0000064

-------

-System
-Provider
[
Name]
Microsoft-Windows-Security-Auditing
[
Guid]
{54849625-5478-4994-A5BA-3E3B0328C30D}
EventID4776
Version0
Level0
Task14336
Opcode0
Keywords0x8010000000000000
-TimeCreated
[
SystemTime]
2014-01-10T07:56:59.120273200Z
EventRecordID90264197
Correlation
-Execution
[
ProcessID]
488 (This is lsass.exe)
[
ThreadID]
4196
ChannelSecurity
Computerthe same computer
Security
-EventData
PackageNameMICROSOFT_AUTHENTICATION_PACKAGE_V1_0
TargetUserNamesales
Workstationthe same computer
Status

0xc0000064

Guys How could I troubleshoot this to stop happening?

Thanks


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>