https://community.splunk.com/t5/Security/Windows-user-account-lockout/m-p/430280#M10135 <P>HI,</P> <P>maybe this could help you?</P> <P><A href="https://social.technet.microsoft.com/Forums/windows/en-US/db2719af-387c-499f-afd5-74ea021ce135/audit-failure-4776-blank-workstation?forum=winserverDS">https://social.technet.microsoft.com/Forums/windows/en-US/db2719af-387c-499f-afd5-74ea021ce135/audit-failure-4776-blank-workstation?forum=winserverDS</A></P> Mon, 28 Jan 2019 21:17:30 GMT dkeck 2019-01-28T21:17:30Z https://community.splunk.com/t5/Security/Windows-user-account-lockout/m-p/430279#M10134 <P>Trying to track down a recurring account lockout source but the WORKSTATION SOURCE is blank in the event. Any suggestions or insight as to why it's blank? I have several Windows &amp; AD Apps/TA's installed.</P> Mon, 28 Jan 2019 20:34:55 GMT https://community.splunk.com/t5/Security/Windows-user-account-lockout/m-p/430279#M10134 sbgoldberg13 2019-01-28T20:34:55Z https://community.splunk.com/t5/Security/Windows-user-account-lockout/m-p/430280#M10135 <P>HI,</P> <P>maybe this could help you?</P> <P><A href="https://social.technet.microsoft.com/Forums/windows/en-US/db2719af-387c-499f-afd5-74ea021ce135/audit-failure-4776-blank-workstation?forum=winserverDS">https://social.technet.microsoft.com/Forums/windows/en-US/db2719af-387c-499f-afd5-74ea021ce135/audit-failure-4776-blank-workstation?forum=winserverDS</A></P> Mon, 28 Jan 2019 21:17:30 GMT https://community.splunk.com/t5/Security/Windows-user-account-lockout/m-p/430280#M10135 dkeck 2019-01-28T21:17:30Z