Event ID 4776: the computer attempted to validate the credentials for an account
Event 4776 is written whenever a password is checked with NTLM – on the domain controller for domain accounts, or on the computer itself for local accounts. Where Kerberos is not used (local accounts, access by IP address, old devices, many attacks), this is where wrong passwords and guessing show up.
- What it is: an NTLM password check. Success or failure is in the Error Code.
- Where: domain controller for domain accounts; the computer itself for local accounts.
- Key fields: Logon Account, Source Workstation, Error Code.
- Limit: it shows the workstation name, not the IP address – the matching 4625 on the target Server has the address.
1. Status codes
| Code | Meaning |
|---|---|
| 0x0 | Success |
| 0xC000006A | Wrong password for an existing account |
| 0xC0000064 | Account name does not exist |
| 0xC0000234 | Account locked out |
| 0xC0000072 | Account disabled |
| 0xC000006F | Outside allowed logon hours |
| 0xC0000070 | Not allowed from this workstation |
| 0xC0000071 | Password expired |
| 0xC0000193 | Account expired |
| 0xC0000224 | User must change password at next logon |
Audit subcategory Credential Validation.
2. PowerShell: NTLM failures by account and workstation
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4776; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
ForEach-Object { Get-EventFields $_ } | Where-Object Status -ne '0x0' |
Group-Object Status, TargetUserName, Workstation | Sort-Object Count -Descending | Select-Object -First 25 Count, NameMany 0xC0000064 for different names from one workstation = someone guessing account names. Many 0xC000006A for one account = password guessing or an old saved password (a mapped drive, a phone, a service).
3. Finding the real source
- The Source Workstation is the name the client sent – attackers can send anything, and it is empty for some tools.
- On the Server that was accessed, the matching 4625 holds the IP address.
- For a lockout that keeps coming back, see 4740: the Caller Computer Name points to the device with the old password.
4. Let Coinetic watch it for you
Coinetic works where most of these logons start – on the way in:
- Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
- Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
- Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Why does a domain controller log 4776 for a logon at a member Server?
With NTLM the member Server passes the check to the domain controller, which validates the password and logs 4776.
Should NTLM be switched off?
Reducing NTLM is good practice, but switching it off breaks old devices and access by IP address. First audit NTLM use (the Restrict NTLM audit policies), then reduce it step by step.
Why is the workstation name empty?
Some clients and attack tools do not send it. Use the 4625 on the target Server to get the address.