locked
Server Security Event 4776 - source workstation IP RRS feed

  • Question

  • I'm getting some bad login attempts (event 4776) on my domain controller.  I think someone is hacking on me because the Source Workstation is listed as a machine name that doesn't exist on my network.   They're trying the guest account (which is disabled) as well as a few account names that don't exist in our AD.

    I'm trying to figure out where these are coming from, but all I've got is a non-existent source workstation name.  I can't find a way to tie this back to an IP address or some service that's calling for the authentication.  Does anyone have a suggestion?

    The DCs are running Server 2008 Standard SP2.

    Thanks

    Patrick

    Thursday, December 26, 2013 10:57 PM

Answers

All replies