Event 4768 for one user

Hi, if this is isolated to one user, I would look at that account and the device they are signing in from before assuming the domain controllers are the problem.

Good checks:

1. Confirm whether the failures come from one workstation, one app, or many systems.

2. Check the 4768 failure code and client address in the event details.

3. Clear stored credentials on the user's device, including Credential Manager, mapped drives, mobile mail apps, and old RDP sessions.

4. Confirm the account is not locked, expired, or recently changed in a way that old credentials are still being reused.

5. If the user recently changed password, check services or scheduled tasks running under that user account.

The client address and failure code should point you toward whether this is a stale password, time/Kerberos issue, or one device repeatedly trying bad credentials.