Hi I downloaded the free version of Netwrix account lockout examiner in order to troubleshoot few users account that are always locked out. I tried to look for the workstation but the workstation gave me that blank answer. Is there anyone can help me to show which machine caused the user account locked out? I meant enabled the feature on the software.
Account lockout examiner gets the workstation from the 4740 event ID on the domain controller which processed the lockout ( If we show workstation as blank then that means that the event ID has a blank workstation. However if you pull up that event on the DC then it may have an IP address associated with the device. If I had to guess it is a non microsoft windows device and that is why windows doesn't have a workstation name.