Audit Failure (Event ID 4625)

Hello, a server being used by the company I work for had \~35k events of event ID 4625. If I am understanding this correctly, it looks like someone was trying to use common passwords for common usernames to brute force a login into the server. The workstation Name and Source Network Address were unique every time. The Account names attempted were not even on the server and I would be the only person who should be logging into it.

Since …

address audit brute common passwords cybersecurity event events failure hello login name network passwords server the company understanding usernames work workstation