you must identify the source of the anonymous workstation. In this case: Install third-party tools like a packet sniffer on the domain controller to seize the traffic alongside these events.
Some results have been hidden because they may be inaccessible to you