4776 DC vs Member server Authentication Expand / Collapse
Author
Message
Posted 9/19/2016 5:59:12 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/23/2016 10:02:36 AM
Posts: 2, Visits: 10
Hello.
I see two different names for event 4776:
- "The computer attempted to validate the credentials for an account."
- "The domain controller attempted to validate the credentials for an account."

Can i always use event name to determine authentication occur on DC or on Member Server?
Post #6264
Posted 9/26/2016 6:40:52 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
It is recommended to use the event ID but you should also look at Kerberos authentication since 4776 only refers to NTLM auth. "For Kerberos authentication see event 4768, 4769 and 4771."
Post #6269
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 6:42am