Event ID 4776 - Failed Authentication with Source Workstation:0xc000006a and Error Code:%4

Question

Hello,

I'm trying to analyze failed login attempts and I see that most logs don't show source workstation. usually it's 0xc000006a or 0xc0000234 with Error Code:%4. I'm not sure how to interpret these logs. I would appraciate any help. Thank you

Answer 1

Hello there,

Have you Enabled the 'Audit Logon Events' policy?

Event ID 4776 shows only the computer name (Source Workstation) from which the authentication attempt was performed (authentication source). For example, if you authenticate from CLIENT-1 to SERVER-1 using a domain account you'll see CLIENT-1 in the Source Workstation field. Information about the destination computer (SERVER-1) isn't presented in this event.

Error code "error 4" is one of the issues that users may get as a result of incorrect or failed installation or uninstallation of software that may have left invalid entries in system elements.

Try to install Process Monitor on the server and capture what's happening during Failed Login attempts. Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry, and process/thread activity. You can get the tool from here https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–