The source workstation is empty in Windows Logs. How to find it?

Source: security.stackexchange.com --- Tuesday, May 30, 2017
First, I apologise if I selected a wrong thread for this question. I receive lots of login failures on a DC for an account called as a domain. So obviously instead of a username, someone put there a domain name. And I'm trying to figure out the source of login failures and remediate it. Please see blow Windows error messages: <13>May 30 09:07:43 x.x.x.x(IP address of a DC) AgentDevice=WindowsLog AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing Computer=computer.domain.com User= Domain= EventID=4625 EventIDCode=4625 EventType=16 EventCategory=12544 RecordNumber=xxxxxx TimeGenerated=1496134771119 TimeWritten=1496134771119 Message=An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: DOMAIN_NAME Account Domain: Failure Information: Failure Reason: %%2313 Status: 0xc000006d Sub Status: 0xc0000064 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 <13>May 30 09:07:43 x.x.x.x(IP address of a DC) AgentDevice=WindowsLog AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing Computer=computer.domain.com User= Domain= EventID=4776 EventI ...

from Windows http://ift.tt/2qxaQPW