If you are debugging why a particular user always is being locked out with his/her domain account, then you may want to give this tool a spin. It’s a freebie from Microsoft called “Account Lockout Status“, and what it will do is to let you see some useful info on the users bad password count etc. on all Domain Controllers in the domain. Useful stuff even if it’s a golden oldie by now 🙂
JSI also has a few lines about it
You can also get a ‘package deal’ called “Account Lockout and Management Tools” from Microsoft that includes some additional utilities, among others an advanced Eventlog filter (can gather from several servers and filter in different ways) and can also be tweaked to display some additional info from AD on each userobject.
There is a good Technet article on it here;
http://technet.microsoft.com/en-us/library/cc738772(WS.10).aspx
This includes how to install and uninstall the debugging DLL’s.