Lockedout Event not showing the right source computer data (4299941)

In some cases, Change Auditor is showing a an incorrect source computer for a Locked Out Event

This issue is not caused by Change Auditor but by the way the event is created in Active Directory

Change Auditor Agent uses a DLL Hook to capture data directly from LSASS.exe

This data come directly from Active Directory, for example so when a Locked Out event is generated on a Domain Controller

When a Locked Out event occurs, Change Auditor sees an attribute change to the User Object lockouttime

CA Agent determines then the Origin based on the Caller Computer in the lockouttime modification

This process mirrors the way Windows Event logs works (i.e: ID 4740)

Solution

This is per design

Workaround

How to identify the Origin of the Locked Out Event

1. Select the Logon Failed event corresponding
2. Ignore the Workstation Name but look for Source Network Address and do a Reverse DNS
3. Please note that this might not always be accurate