ZEKASTRA

SecurityKerberos and NTLM authentication

4776 · The computer attempted to validate the credentials for an account

Generated on the computer authoritative for the credentials whenever NTLM credential validation succeeds or fails: the domain controller for domain accounts, the local computer for local accounts.

01Fields in the event

  • PackageName
  • TargetUserName
  • Workstation
  • Status

02How to use it

Workstation names the origin of the attempt, not the destination. Use Status codes (for example 0xC000006A bad password, 0xC0000064 unknown user) to classify failures, and look for NTLM use where Kerberos is expected.

03Caveats

Requires Audit Credential Validation. It does not record which server the user was trying to reach, and it is not generated when a domain account logs on locally to a domain controller.

05Sources

  1. Microsoft Learn — 4776(S, F) The computer attempted to validate the credentials for an account checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.