Disabled Guest Account Failed Sign in Attempts Event ID 4776

Question

In our environment, I've found a handful of Event ID 4776 The computer attempted to validate the credentials for an account. Shown below is the output of that event log and it seems the user in question is Guest, which is a disabled account:

[

](https://i.stack.imgur.com/fV6Rl.png)

I've also found a corresponding Event ID 4625, shown below, from the same time and same Guest user. However, for this event id, I can see Subject Username for which I'm trying to hunt down the user.

[

](https://i.stack.imgur.com/B1hSB.png)

My questions are:

• Can someone provide insight on why a disabled Guest account is trying to sign in?
• For Event ID 4625, what is the difference between Subject User Name and Target User Name? I have an idea but I don't want to assume.

Answer 1

Check this article for more insight - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776