Event 4776 with no information…

This type of event in the eventlog does not tell you very much about the root cause.

Event: 4776
The computer attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:
Source Workstation:
Error Code: 0xc0000064

The error code could also be something else, i:e
0xc000006a – The username is correct, but the password is wrong.

Usually you see more information i.e. Source Workstation or Username but not in this case.

I have seen examples origination from Microsoft Internet Authentication Server, Microsoft Network Policy Server, Bluecoat BCAAA authentication agent. All of these can produce this kind of event with no further information.

Easiest way to find out more is to enable Netlogon debug logging. That log will hopefully tell you where to start looking.

 

This entry was posted in Active Directory, Windows and tagged , , , , . Bookmark the permalink.