I've got a newly installed Logon Activity monitor that sends me an email each morning. From the start there has been MANY logon failures for an admin acct (and there a few users that are having the same issue, I'll stay focused on the admin issue.)
How can I determine where the failed logins are coming from. It shows that the workstation is domain controller server,
Details:Cause: Pre-authentication information was invalid: usually means bad password.
This entry represents 60 matching events occurring within 600 seconds.
It appears there is a program set to activate, but the admin user/pw is invalid, but I can't find where it is coming from.
Is there help out there for me?