Frequent AD account lockouts Event 4226. Source Workstation is blank.

I had this question after viewing Active Directory User Id frequently locked out.

4776,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Mon Jul 18 09:14:30 2016,No User,The computer attempted to validate the credentials for an account.    Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  Logon Account: xxx  Source Workstation:   Error Code: 0xc000006a
Who is Participating?

Improve company productivity with a Business Account.Sign Up

Britt ThompsonSr. Systems EngineerCommented:
If you have an Exchange Server you may have a user with a device constantly checking email with an incorrect username or password. Or, there could be a device on the network (i.e., a copier) using LDAP authentication to copy to file or email with an incorrect password.
Senior IT System EngineerIT ProfessionalCommented:
Or it could be the iTunes password or any proxy credentials error ?
jae1Author Commented:
Turned out to be an IP phone, however we were never able to get the source by using the logs.
jae1Author Commented:
Good info
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.