Event ID 4776: ntlm credential validation
What Event ID 4776 (ntlm credential validation) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4776 is written when a domain controller (or a local machine, for local accounts) validates an NTLM credential. It shows NTLM failures that never appear as 4771, and it is the starting point for finding where NTLM is still used.
The fields that matter
| Field | What it tells you |
|---|---|
| Logon Account | The account being validated. |
| Source Workstation | The name the client sent. It can be spoofed and is sometimes blank. |
| Error Code | 0x0 success, 0xC000006A wrong password, 0xC0000064 no such user, 0xC0000234 locked, 0xC0000072 disabled. |
What is normal
Successful validations from known workstations and from applications that only support NTLM.
When Event ID 4776 is suspicious
- Many accounts failing from one source workstation: password spraying over NTLM.
- Workstation names that are not in your domain, or random-looking names.
- NTLM use by admin accounts where Kerberos should be used.
Common false positive: Older apps, printers and scanners use NTLM legitimately. Record them before you start blocking NTLM.
Find Event ID 4776 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4776; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4776
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4625: Failed logon
- Event ID 4771: Kerberos pre-authentication failed
- Event ID 4624: Successful logon
- Event ID 4740: Account locked out
FAQ
Where do I see the source IP for NTLM failures?
4776 has only the workstation name. The matching 4625 on the server the user connected to has the source address.
Can 4776 help me turn off NTLM?
Yes. Successful 4776 events list which accounts and workstations still use NTLM, which is the inventory you need before restricting it.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.