This article will show you how to find a computer that is locking a user Active Directory account.
In this article I’ll use two tools to get the data.
The first tool is Microsoft Account Lockout and Management Tools from the link below:
http://www.microsoft.com/en-au/download/details.aspx?id=18465
The second tool Is the Event Viewer on the DC.
Once you download the Account Lockout Tool save it run it
Open the extracted files and run LockoutStatus.exe as administrator
Open the tool and click on File -> Select
Target
In the Target User Name type the User ID that his \ her account Is getting locked Out
In the second Username option type the Administrator account details.
If you running the tool from a DC you can tick the box.
View the returned results and note the Orig Lock DC
Log In to the DC and create a filter In the security log for the last 24 hours with event ID 4740 and click OK
Select the event from the result
Note the Caller computer Name
