Hi.  I don't think it is a user attempting to log in with that username.  It happens each time I reboot a DC.  Also the source workstation in the event message shows as the Meraki MAC address (preceded with an M).  And the logon attempt shows as "WORKGROUP" as opposed to our domain name, leading me to think it is coming from the firewall.     (BTW it's an MX95, not MX68 as originally posted.  Corrected now.  Got confused with another MX we've got.)   Never considered the Azure/Entra authentication option.  Looks like you need to get it enabled via a support ticket.  Will do some reading into it though, thanks.  However I get the nagging feeling it ought to "just work" as it is.   ... View more