Banks, credit unions, insurance companies,
NetWrix Account Lockout Examiner relies on the Windows audit system.
Name of the process is logged in the invalid logon event (4625 in Windows Vista/2008/7/2008R2, events 529-539 in older versions).
Account Lockout Examiner will not show name of the process if either there is no corresponding invalid logon event or the name of the process is not tracked by Windows Audit.
This can occur due to several reasons, for example:
There are a lot of other situations when a name of a process can be not logged. The easiest way to make sure that Account Lockout Examiner reflects all information correctly is to manually check invalid logon event in Security log.