4774: An account was mapped for logon

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

I have not actually seen this event logged by Windows but suspect that if it is logged at all it would be in conjunction with IIS's certificate mapping capability where users are authenticated via a client certificate which is then mapped to a Windows user account according to mapping rules defined in IIS.

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Description Fields in 4774   Authentication Package: %1  Account UPN: %2  Mapped Name: %3 Top 10 Windows Security Events to Monitor Examples of 4774 An account was mapped for logon.     Authentication Package: %1    Account UPN: %2    Mapped Name: %3 Keep me up-to-date on the Windows Security Log. Email*: *We will NOT share this

Training for the Windows Security Log

Discussions on Event ID 4774 Ask a question about this event

 

Upcoming Webinars Cutting through the Hype: What is Big Data Security Analytics? Top 6 Security Events to Monitor in SQL Server Top 10 Security Events to Monitor in SharePoint

Additional Resources Security Log Quick Reference Chart Learn about the SharePoint Audit Log Patch Tuesday Analysis

•	All Event IDs
•	Audit Policy