Hi,

I keep seeing the local administrator account on 1 of our DCs getting locked out, event # 4740 but it reports the caller machine name as B_104 and the caller IP address as B_104 (policy is set to unlock after 5 minutes)... the next lockout will have a different name and number but the same convention (B_111, B_21 etc).

We have no machines named that and the IP is obviously wrong. 

Has anyone else seen this? What could be causing this?

Thanks,