Forum Discussion
How to find the source IP of 4776 events?
Can Azure ATP help me in identifying the source IP of a 4776 event (The domain controller attempted to validate the credentials for an account)? Now often there is no source (IP/computer) informatio...
I have the same issue as yours, no 8004 event generated. Did you fix your issue?
NaturelDragon Not sure if this helps, but the 8004 events don't get logged to the Security Log, it took me a while to figure it out, instead they are in the windows > NTLM > Operational log. All the docs about this don't mention where the event gets generated and obviously everyone just assumes it will be in the Security log with the reset of the Audit messages.