Windows Security Log Event ID 4776

4776: The domain controller attempted to validate the credentials for an account

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Despite what this event says, the computer is not necessarily a domain controller; member servers and workstations also log this event for logon attempts with local SAM accounts.

When a domain controller successfully authenticates a user via NTLM (instead of Kerberos), the DC logs this event. This specifies which user account who logged on (Account Name) as well as the client computer's name from which the user initiated the logon in the Workstation field.

For Kerberos authentication see event 4768, 4769 and 4771.

This event is also logged on member servers and workstations when someone attempts to logon with a local account. 

Authentication Package: Always "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"

Logon Account: name of the account

Source Workstation: computer name where logon attempt originated

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4776

Error Code:

C0000064	user name does not exist
C000006A	user name is correct but the password is wrong
C0000234	user is currently locked out
C0000072	account is currently disabled
C000006F	user tried to logon outside his day of week or time of day restrictions
C0000070	workstation restriction
C0000193	account expiration
C0000071	expired password
C0000224	user is required to change password at next logon
C0000225	evidently a bug in Windows and not a risk

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

Mini-Seminars Covering Event ID 4776 Security Log Exposed: What is the Difference Between “Account Logon” and “Logon/Logoff” Events? Insider Gone Bad: Tracking Their Steps and Building Your Case with the Security Log 27 Most Important Windows Security Events Daily Security Log Check for the SMB IT Admin How to do Logon Session Auditing with the Windows Security Log Anatomy of an Attack: How Password Spraying Exploits Weak Passwords So Effectively 4 Threat Detections using Active Directory Authentication Events from the Windows Security Log Understanding Active Directory Authentication Events in the Windows Security Log and Beyond Security Log Deep Dive: Mapping Active Directory Authentication and Account Management Events to MITRE ATT&CK TTPs Detecting and Preventing AD Authentication Risks: Golden Tickets, NTLM, Pass-the-Hash and Beyond Top 10 Windows Security Log Events to Monitor to Detect Lateral Movement Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy