Windows Event Viewer shows events with id 4776 and error code 0xC0000064 in the Security log (4299845)

Event Viewer shows multiple events with id 4776 in the Security log.

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: svc_foglight
Source Workstation: FGLAMHOSTNAME
Error code: 0xC0000064

Source Workstation is showing these are coming from the FglAM (Agent Manager) and the Logon Account is a service account used for monitoring this server.

Microsoft docs show these two facts about this event:

1. This event suggests the FglAM is trying to connect to this server using a local account called svc_foglight via NTLM
2. Error code 0xC0000064 means the user name does not exist

This events will show up in a Domain controller if the Logon Account is a domain account, but if it shows up on a regular workstation of the domain, then the likely cause is that the login attempt is not passing the domain name so it thinks the login name is a local account when it should be a domain account.

1. Check for any Credentials that match the Logon Account. Make sure the credential properties have the Domain field filled correctly.
2. Check for any other agents monitoring this server, make sure they're using the correct account and the domain is specified correctly.