Dear all

 i have an issue about locked user, i have 1 user always locked every 2 hour or it can be 1 hours periodically.ihave policy 5 time loginwith wrong password account will be lockedout.

i trace using eventvwr audit only have a clue :

 the questio: can i know wich user try to use pass login n make user locked out with input the wrong password

pls need help 

Hi Yogi, 

Have u tried to scan the user computer ? I had the same problem before, it was an virus issue, that try to login everytime with generate password, 

so what happen after that was AD keep locked the user.

Thank you.