Disabled Guest Account Failed Sign in Attempts Event ID 4776

Nina G 46 Reputation points
2023-02-24T16:00:20.0166667+00:00

In our environment, I've found a handful of Event ID 4776 The computer attempted to validate the credentials for an account. Shown below is the output of that event log and it seems the user in question is Guest, which is a disabled account:

[enter image description here

](https://i.stack.imgur.com/fV6Rl.png)

I've also found a corresponding Event ID 4625, shown below, from the same time and same Guest user. However, for this event id, I can see Subject Username for which I'm trying to hunt down the user.

[enter image description here

](https://i.stack.imgur.com/B1hSB.png)

My questions are:

  • Can someone provide insight on why a disabled Guest account is trying to sign in?
  • For Event ID 4625, what is the difference between Subject User Name and Target User Name? I have an idea but I don't want to assume.
Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,431 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,029 questions
0 comments No comments
{count} vote

1 answer

Sort by: Most helpful
  1. Amit Singh 4,846 Reputation points
    2023-02-27T07:17:16.1233333+00:00
    0 comments No comments