Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 644
Date: 9/18/2006
Time: 3:48:00 PM
User: NT AUTHORITY\SYSTEM
Computer: domaincontnroller
Description:
User Account Locked Out:
Target Account Name: user.name
Target Account ID: domainname\user.name
Caller Machine Name: AMERICAN-WS1
Caller User Name: servername$
Caller Domain: domain
Caller Logon ID: (0x0,0x3E7)

i dont how to exactly interpret this when the caller machine name does
not exist on the domain where user account is locked.

Somebody put a computer with that name on your network and entered the
credentials as domain\user

Ray

"ron" <ronpadilla@gmail.com> wrote in message
news:1158612050.920703.155320@d34g2000cwd.googlegr oups.com...
> Event Type: Success Audit
> Event Source: Security
> Event Category: Account Management
> Event ID: 644
> Date: 9/18/2006
> Time: 3:48:00 PM
> User: NT AUTHORITY\SYSTEM
> Computer: domaincontnroller
> Description:
> User Account Locked Out:
> Target Account Name: user.name
> Target Account ID: domainname\user.name
> Caller Machine Name: AMERICAN-WS1
> Caller User Name: servername$
> Caller Domain: domain
> Caller Logon ID: (0x0,0x3E7)
>
> i dont how to exactly interpret this when the caller machine name does
> not exist on the domain where user account is locked.
>