Can you clarify what it is you are asking.
As you observe, the logon name, domain and workstation name
are recorded in the login failure security event log messages.
The workstation name comes from the messages used in the
logon attempt(s) that fail.
When a account gets locked out, it registers an entry in AD with the
logon name, domain and workstation name. Where does the workstation
name get populated? How does it get populated>
Re: Daily Server Report (Critical Errors, Event ID: 537) ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network?... (microsoft.public.windows.server.sbs)
Re: Daily Server Report (Critical Errors, Event ID: 537) ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network?... (microsoft.public.windows.server.sbs)
Re: Users cannot access remote web workplace without admin access ...RWW site logon issue ... When we create the user accounts by using the SBS add users ...workstation through the RWW-RDP connection? ... For the RDP access issue, it could be an expected behavior. ... (microsoft.public.windows.server.sbs)
Re: How list all current logon NT domain users? ... > last logon time, but not give the logoff time.... required to exist while the user remains logged on to a workstation or TS ..."agent" on every single workstation, ... (microsoft.public.win32.programmer.kernel)
Re: Event ID 539 & 529 in large numbers - from what? ... When I get an account locking out without obvious cause, I just go in and delete all the saved passwords. ... Both the username and the workstation name are legitimate user/workstation on the network. ...Logon Failure:...Caller User Name: - ... (microsoft.public.windows.server.sbs)
