I have accounts locking out frequently after users change passwords. I have now experienced this with my account. I have checked my PC and there seem to be no programs with cached credentials that may be knocking on the domain using expired passwords. The account still gets locked even when my pc is off the network which may mean its nothing to do with programs on my pc.
Checking the logs on the DC, I dont seem to find any log entries that point to the actual processes locking the account save for that which is logged when I try to access a locked account. I have changed my password back to the last one which had no problems but still the problems persists.
I have 3 DCs (2 in one site and the other off site) and they seem to be replicating very well. Is there a tool I can use to find out the root of the problem?