DLP endpoint incident detection and location

We have a customer in China, just won the 2000 point DLP endpoint prevent. But in the implementation process encountered a serious problem:
The user’s computer is in the workgroup environment. The computer name is random. Login user name is administrator.. The IP address is assigned by the DHCP server.
In the endpoint  incident . Because the computer name, IP address, and user name are not standard, we cannot find the person who violated the case.
Does anybody has any suggestions?