Event ID 4776 Show Different Workstation Name


  • There were windows 7 computers running in the Windows 2008 R2 domain.

    I found that there were event ID 4776 got logged on domain controller and user report that the he account got locked sometimes

    However, the source workstation show the different computer name which not the one end user currently use.

    Let say, the end user "Domain\111" use the work station name is "ABC" but the source workstation show "DEF" in event ID 4776 found on DC.

    Both "ABC" and "DEF" computer exist in same domain.

    I have check that the user account "Domain\111" did not logon to "DEF" computer as no any user profile there. I also check there were no any schedule task using the with "Domain\11" on "DEF" computer.

    So, i would like to know if there were any other way could figure out why this issue would be occurred.

    Thanks for any suggestion.


    Tuesday, July 09, 2013 2:57 PM

All replies

  • Other than scheduled task, it could be some services or applications that are running on the maching under this user account on the workstation DEF. Collecting a network trace / Process monitor logs can help you find what process what traffic causing this when the event ID occurs.
    Monday, September 15, 2014 10:57 AM