← cd ~/events
// events/4776 · Sign-in
Event ID 4776The computer attempted to validate the credentials for an account
An NTLM credential check. It is logged on the computer that owns the credentials: the domain controller for domain accounts, or the local machine for local accounts.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Sign-in |
What to check
Use the Error Code and Source Workstation to find the cause. Bad user names may mean enumeration; bad passwords and lockouts may mean brute force.
Codes you'll see in this event
| Code | Meaning |
|---|---|
0xC0000064 | User name does not exist. |
0xC000006A | Wrong password. |
0xC000006D | Generic logon failure, for example bad credentials or a LAN Manager authentication level mismatch. |
0xC000006F | Outside permitted logon hours. |
0xC0000070 | Unauthorised workstation. |
0xC0000071 | Password has expired. |
0xC0000072 | Account disabled. |
0xC0000193 | Account has expired. |
0xC0000224 | User must change password at next logon. |
0xC0000234 | Account is locked out. |
0xC0000371 | Local account store has no secret material for the account. |
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4776 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4776
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Sign-in events
- Event ID 4624: An account was successfully logged on
- Event ID 4625: An account failed to log on
- Event ID 4634: An account was logged off
- Event ID 4647: User initiated logoff
- Event ID 4648: A logon was attempted using explicit credentials
- Event ID 4672: Special privileges assigned to new logon