A SOC analyst is investigating a report that a domain user account was repeatedly locked out during off-hours. Reviewing the Windows Security event logs from several domain-joined workstations and the domain controller, the analyst wants to identify the source host generating the failed authentication attempts that triggered the lockouts. Which Event ID and field combination should the analyst prioritize to pinpoint the originating system?