MonitorWare Knowledge Base

I hope someone can help me with this - I can't find any info out there!
I have a series of logon failure recorded to one of the File+Print servers on my mixed-mode W2K3 domain (2000/XP clients).

Event ID 539
Logon Failure
Reason: Account locked out
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: FILESERVER$
Caller User Name: FILESERVER$
Caller Domain: <snipped - but the domain name was correct>

I don't understand why the User Name and Domain fields are blank! Also, if the logon failed due to the account being locked out, what account object was referenced? If an account doesn't exist (username blank) how can it be locked out?

I would like to get to the bottom of this, as it has me stumped.