Enable verbose user account logging in order to determine where failed authentication attempts are originating from. Log into primary domain controller. Enable verbose netlogon logs using command nltest /dbflag:0x2080ffff This will enable us to pinpoint which device these failure authentications are originating from. Log file: %windir%\debug\netlogon.log Once log has been accumulated sufficiently, disable verbose login … Continue reading Identify failed logon desktop or device