When a user's account is locked out, Change Auditor is supposed to display the workstation or server where the lockout took place from. In some cases, generally involving a user's mobile device, or other non-domain joined device, Change Auditor may report an origin value that is incorrect, and not make any sense.
The Security Event Log on the Domain Controller which processed the Lockout event has a blank value in the event for the origin workstation.
Change Auditor would attempt to determine the appropriate workstation from corresponding logon failures happening at the same time on the Domain Controller and detect the wrong value.
WORKAROUND
None.
STATUS
This is fixed in Change Auditor 5.9.60+, 6.0.220+, 6.5.146+ and 6.6 GA (6.6.407+).
