Recently locked out report - reporting unknown machine and IP

Recently locked out report - reporting unknown machine and IP

Hi,

I keep seeing the local administrator account on 1 of our DCs getting locked out, event # 4740 but it reports the caller machine name as B_104 and the caller IP address as B_104 (policy is set to unlock after 5 minutes)... the next lockout will have a different name and number but the same convention (B_111, B_21 etc).
We have no machines named that and the IP is obviously wrong. 
Has anyone else seen this? What could be causing this?

Thanks,

      New to ADSelfService Plus?

        Resources

                Related Products