There were windows 7 computers running in the Windows 2008 R2 domain.
I found that there were event ID 4776 got logged on domain controller and user report that the he account got locked sometimes
However, the source workstation show the different computer name which not the one end user currently use.
Let say, the end user "Domain\111" use the work station name is "ABC" but the source workstation show "DEF" in event ID 4776 found on DC.
Both "ABC" and "DEF" computer exist in same domain.
I have check that the user account "Domain\111" did not logon to "DEF" computer as no any user profile there. I also check there were no any schedule task using the with "Domain\11" on "DEF" computer.
So, i would like to know if there were any other way could figure out why this issue would be occurred.
Thanks for any suggestion.
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.
Would you like to participate?