WinSecWiki > Security Settings > Advanced Audit Policies > Account Logon > Credential Validation

Audit Credential Validation

This subcategory generates one and only one event ID. These events are generated on workstations, members servers and domain controllers despite the title of the event. To configure this on Server 2008 and Vista you must use auditpol. Windows 7 and Server 2008 R2 can use Group Policy.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4776	The domain controller attempted to validate the credentials for an account.

Back to top

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources