For reference - in LEM, 4625 will either appear as MachineLogonFailure or UserLogonFailure, depending on whether the account name has a $... I'm not sure how the null SID and other details will appear, though, so if you get those details I'll be curious to see if we can distinguish them and how it looks in the event log.
↧