We are having issues with frequently locked out accounts.
We are having 4771 {Bad Password} events on our main DC. Issue: Within the event, the client machine is not properly shown. Instead another DC is shown as client host name:
only in rare occasions the actual client host name is shown. What could be the cause for this?