Identify failed logon desktop or device

Enable verbose user account logging in order to determine where failed authentication attempts are originating from.

Log into primary domain controller.
Enable verbose netlogon logs using command

nltest /dbflag:0x2080ffff

This will enable us to pinpoint which device these failure authentications are originating from.

Log file:


Once log has been accumulated sufficiently, disable verbose login using command

nltest /dbflag:0x0


Traverse through the log file and locate Return C0000234 errors which will pinpoint problem desktop or device.