How to find out who is breaking under the UZ guest?

Question

Active Directory

Good afternoon! There is a CD, local KMs of the type Guest and administrator are disabled, but the event is constantly observed in the log files: Use of the standard KU Guest/administrator has been detected.
With what it can be connected?

Answer 1

Logon failure: account currently disabled
Event Class ID = 4776

there in details of event there is an initial workstation . This is the name of the computer that is breaking into the server over the network. Identify the computer by name - deal with it further.