id 4648

Event ID 4648 in Windows Event Viewer indicates a logon attempt using explicit credentials, often triggered when a user accesses a network resource with alternate credentials. In this context, a non-domain computer accessing a folder on a file server via a shortcut with Active Directory credentials can generate numerous ID 4648 events. The issue is compounded when the associated user account becomes locked in Active Directory repeatedly. Troubleshooting involves examining the event details for the source process and target server, checking for scheduled tasks or services using stored credentials, and reviewing security logs for related events like 4625. This tag covers discussions about identifying and resolving excessive ID 4648 events and account lockouts.