I have a user who gets locked out occasionally (been a few weeks since the last time). The bad password attempts show as a time where he was successfully logged into his computer and working. I looked in the event logs on the DC and see some
4776 Audit failures for this user, with the error code 0xc000006a, which I believe means bad password. However, the "Source Workstation" field is blank. How can I track down where these bad attempts are coming from?
↧