Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm not familiar with the Active Directory and a User keeps getting locked out of their account for no reason at all. I am trying to find a 'log' to see when they log on/off but can not seem to find one.

share|improve this question

marked as duplicate by Greg Askew, dunxd, mdpc, voretaq7 Apr 3 '13 at 16:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

You should enable auditing of "Account Logon Events" in "Domain Controller Security Policy".

You should then be able to see logon events in the Event Viewer on the DC.

share|improve this answer

I would tend to lean more toward the user is fat fingering their password.

Here's an article on it though: Finding why a user is locked out in Active Directory

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.