We have a user that was locked out but never logged into the computer that is referenced in the 4776 events for the lockout. The source workstation in the events is represented as\\abccomputer. My question is why does the source computer look like a UNC path? We have other 4776 events that are not that way - they just list the computer name. We have checked the event log on the computer in quetsion and there are no security events listed for the user.
Thanks,
Crystal