Event ID 4776 unknown workstation

Dusan Bulajic 70 Reputation points
2023-01-24T09:13:10.5+00:00

Hi

I am seeing this event for like 8 different users and they all have same source workstation.

We do not have this workstation in our network (d06-03deb09).

This happens frequently enough to lock those users 2-5 times a day

(over the holidays when those people didn't work no one got locked).

I fixed this for 2 users by changing their username (but this is temporary solution)

Can anyone advise me for what can i do to prevent this from happening?

Is there anything (service or something else) that might cause it.

The screen shot is from event viewer.

Thanks in advance

User's image

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,875 questions
0 comments No comments
{count} votes

Accepted answer
  1. Limitless Technology 44,521 Reputation points
    2023-01-25T19:13:31.88+00:00

    Hello

    Thank you for your question and reaching out. I can understand you are having query\issues related to Event ID 4776

    It seems like some service tried to logon some user with incorrect user credentials. Please check whether there are services that logon as those accounts.

    Also it may due to this account have configured in some Task scheduler or services having older credentials due to which it gets logged as bad password.

    --If the reply is helpful, please Upvote and Accept as answer--

    1 person found this answer helpful.
    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Thameur-BOURBITA 35,436 Reputation points
    2023-01-24T10:57:24.7033333+00:00

    Hi,

    Following the error code and based on microsoft article below ,the user are using a bad password:

    4776(S, F): The computer attempted to validate the credentials for an account.

    Please don't forget to mark helpful answer as accepted

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.