I have a quick question about windows event ID 539. I am supporting security
software for a customer that is not working as designed. This software pulls
information from the Windows event logs and filters them based on the entries
in the logs. I have discovered that the problem comes from the security
software not finding a user name associated with this event. Normally the
event infromation looks like this:

Logon Failure:
Reason: Account locked out
User Name: user1
Domain: <domain name>
Logon Type: 3

My customer's event logs look like this:

Logon Failure:
Reason: Account locked out
User Name:
Domain:
Logon Type: 3

The problem is the user name is blank in the customer's logs. Can anyone
tell me what setting in windows needs to be enabled or disabled to get the
user name to show up in this field?