Event ID 4776: The computer attempted to validate the credentials for an account

Written when NTLM credentials are checked: on a domain controller for domain accounts, or on the local machine for local accounts.

Why it matters

Error Code 0xC000006A is a wrong password and 0xC0000064 an unknown user, the same meanings as in 4625.
NTLM use where Kerberos is expected can point to pass-the-hash or to legacy systems that should be retired.

Check Logon Account, Source Workstation and Error Code. Group failures by workstation to find guessing.

Advanced Audit Policy: Account Logon > Audit Credential Validation.

Status / Sub Status	Meaning
0xC0000064	The user name does not exist.
0xC000006A	The user name is correct but the password is wrong.
0xC000006D	Bad user name or password (general). Check Sub Status for the specific reason.
0xC000006E	Account restriction, such as a blank password not being allowed.
0xC000006F	Logon outside the account's allowed hours.
0xC0000070	Logon from a workstation the account is not allowed to use.
0xC0000071	The password has expired.
0xC0000072	The account is disabled.
0xC0000133	Clocks on the client and domain controller are too far apart.
0xC000015B	The user has not been granted this logon type on this machine.
0xC0000193	The account has expired.
0xC0000224	The user must change their password at next logon.
0xC0000234	The account is locked out.