Successful Brute Force then Attempted Brute Force, same machines/userid.

Signal shows a machine/userid trying to connect to domain controller as a network logon and failing as an expired password. Then userid succeeds. A subsequent signal shortly thereafter shows same failed expired password attempt involving the same devices.