Event ID 4774

An account was mapped for logon

An account was mapped for logon.

Authentication Package: %1
Account UPN:            %2
Mapped Name:            %3

Auditing:

Although this event officially logs both success and failure events, only failure events appear to actually be logged.

Microsoft Documentation

Event ID - 4774

	Field	Insertion String	OS	Example
Authentication Package	MappingBy	%1	Any	Schannel
Account UPN	ClientUserName	%2	Any	host/SERVER15.thedomain.local
Mapped Name	MappedName	%3	Any	SERVER15$


  C:\> AuditPol.exe /get  /subcategory:"Credential Validation"

Account Logon

678

6273 4771

LEFT/RIGHT arrow keys for navigation