Account Lockout Tools Server 2008 R2. For Windows Server 2008 R2 Windows or older version. This tool is called EventCombMTexe.
1 Install the Account Lockout tools from Microsoft and run them. If you have no 3rd party AD auditing tools and want to find out what machine an account is being locked out on perform the following. However if its not working.
LockoutStatusexe - To help collect the relevant logs determines all the domain controllers that are involved in a lockout of a user account.
To search for account lockouts with the new event id in EventCombMT. For Windows Server 2008 R2 Windows or older version. The event IDs filled by default cover older versions of Windows. If I access Win2008R2SvrShare as domainjohndoe and there is a local johndoe account on that server using a different password then the access fails and the local johndoe account is locked out.