Valid Users Failing to Authenticate from Single Source Using NTLM

Detects failed logins with multiple valid domain accounts from a single source system using the NTLM protocol.