On one of our old DC's we are seeing event 4776 logged twice about every 10 min. This server was demoted a year or so ago, so I don't even know why Kerberos requests are going to it. I've gone through the DNS for the domain and all Kerberos entries are all set to the current DCs. The account listed in the event log is an old domain admin account.
All that said, I'm looking for a way to track down where they authentication attempts are originating from. Any ideas?
Event Message:
The computer attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: [domain account]
Source Workstation: LUCIANO
Error Code: 0xC0000064