Hi Hugh,
Sorry about the delay,
ADAudit Plus collects all authentication events that happens in the domain, the following are some scenarios that can cause abnormal events,
- Applications using cached credentials that are stale
- Stale service account passwords cached by Service Control Manager(SCM)
- Stale logon credentials cached by stored usernames/passwords in Control Panel.
- Scheduled tasks and persistent drive mappings that have stale credentials.
- Failure of AD replications between Domain Controllers.
- Stored stale credential to access a file.
The authentication events(Account Logon) will not have more information unless we analyze the local logon events(Logon Events) from the corresponding computers.
To investigate further please check for the "Client Host Name" details against these events. This is the source computer that is generating these abnormal logon events.
On these computers, you need to look for the origin of these events in the above-mentioned scenarios - Services, Schedule tasks, Drive Mappings, Cached Credentials, Logon Sessions etc.,
If you want to troubleshoot this over a remote desktop, please let us know your convenient time and send us an email to "support@adauditplus.com"
Please let us know for any further help, I would be glad to assist.