Workstation Name Is not Shown

Question

Netwrix Account Lockout Examiner shows no data in the Workstation field, while the fields Domain Controller and Lockout Time are populated correctly. Why is it happening?

Answer

Because Netwrix Account Lockout Examiner processes Windows security logs, it only gets the data that is present in those logs. This issue means that the Account locked out event (ID 644 for Windows XP/2003, ID 4740 for the later versions of Windows) contains an empty Caller Machine Name field. Here is an example of the Account locked out event 644 with the empty Caller Machine Name field:

![User-added image]./../0-images/ka04u00000118ES_0EM700000004udP.png)

The field can be empty for events where a local computer account was locked out due to a local policy or as a result of computer synchronization with a mobile device.