Domain Admin password failures after password change

Question

We had an IT member leave who knew the Domain Administrator password so we changed it. Since then all of our domain controllers are reporting login failures all day long (thousands a day). The source is the domain controllers themselves (at least I assume it is as the Client Address is listed as ::1 or 127.0.0.1) and the eventID is 4771 with failure code of 0x18 "Pre-authentication information was invalid" which I believe means bad password. I'm trying to figure out where on the domain controllers this account might be trying to log in. We are not having any performance or visible issues.

I've verified no services are running as this account and there are no scheduled tasks running as this account. Yes, I have rebooted all the servers.

When I look at the event details it shows a processID of 664. Task Manager details shows PID 664 as lsass.exe. If I then look at task manager services, I see PID 664 as the following:

I did check Credential Manager and there are "No Windows credentials."

I'm stuck on how to move forward from here. I hope someone might have seen this type of behavior before and can point me in the right direction before I break down and open a ticket.
The DCs are Windows Server 2019 if that matters.
Thanks for any and all suggestions.

Answer 1

Something here may help.
http://woshub.com/troubleshooting-identify-source-of-active-directory-account-lockouts/

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Thanks but I have seen that article. The account is the domain admin account itself, so it does not get locked out and I've already gotten it narrowed down further than that article can take me.

Answer 3

Might work through this one.
https://theposhwolf.com/howtos/Get-ADUserBadPasswords/

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

I'm sorry but that does not provide any more details than I already have.

Answer 5

You can also start a case here with product support.
https://support.serviceshub.microsoft.com/supportforbusiness

--please don't forget to Accept as answer if the reply is helpful--