Event 644 not reported correctly

I’ve noticed that event ID 644 (account lockout) isn’t reported correctly on NT 4.0 – has anyone noticed this? It’s happened on numerous systems. All the SIDs refer to user accounts. Can anyone shed light on what’s happening?

Here’s an example ofthe correct one:
User Account Locked Out:
Target Account Name: Account1
Target Account ID: S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-1690
Caller Machine Name: Machine1
Caller User Name: SYSTEM
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E7)

Here’s an example of a faulty log:

User Account Locked Out:
Target Account Name:
Target Account ID: SYSTEM
Caller Machine Name: S-1-5-21-xxxxxxxx-xxxxxxxx-xxxxxxxx-2687
Caller User Name: NT AUTHORITY
Caller Domain:(0x0,0x3E7)
Caller Logon ID: –