Bit of an odd one and I’m not sure where to start looking for logs; we have LDAP configured on FreePBX 17. We just recently noticed that when someone opens contacts on their phone, the AD DC will log a failed login attempt, event ID 4625. LDAP users are bound to their extensions and we’re using AD as the primary source for user information. All P series phones.