Event ID: 4774

An account was mapped for logon

An account was mapped for logon.

Authentication Package: %1
Account UPN:            %2
Mapped Name:            %3


Although this event officially logs both success and failure events, only failure events appear to actually be logged.

Microsoft Documentation

Event ID - 4774

Name Field Insertion String OS Example
Authentication Package MappingBy %1 Any Schannel
Account UPN ClientUserName %2 Any host/SERVER15.thedomain.local
Mapped Name MappedName %3 Any SERVER15$

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Credential Validation"

LEFT/RIGHT arrow keys for navigation

Back to List