2 Replies Latest reply on Jul 2, 2014 2:00 PM by HMote

    UserLogonFailure.SourceMachine Keeps Being Blank!


      What would be causing this?  When I run this query...



      I get zero hits, but when I run this query, for the same time frame...



      I get 102 hits.  Obviously, I want the source machine to help research the problem, and I'm pretty sure it used to show up.  As you can imagine, it's hard to track down when this doesn't have the source machine.  I was thinking that it could be audit settings on the authentication server that is not populating this information. 


      Any help would be appreciated.  Thanks!