When running a search for "User Account Locked" events, it is noticed that a few of them have a blank origin.
The usual cause is that the lockout happened locally on the Domain Controller reporting the event. If you review the Event IDs for Account Lockouts (4740 or 644) on the DC reporting the lockout, the Caller Machine value is most likely blank as well.
This is by design. Change Auditor is simply providing the Audit information that LSASS provided.
© ALL RIGHTS RESERVED. Feedback Términos de uso Privacidad Cookie Preference Center