I am receiving lots of Failure Audit logs on my DC, can you guide me - how should i identify the culprit.
Please see the below print-screen for more detail. The logon type is 3, that means it is a network logon. I have identify the Workstation from the log, but how should i prove who or which process is sending broadcast with logon authentication to my DC. The Anti-virus is also updated.
Note:- The Workstation is in Workgroup.