How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7
How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7 Check in the DC, for event 4771 in the Security Log: From the Client Address, you found the source of the problem. Log into the client, check the event log/security log: Here you can see a stored password is causing the problem. Delete the entry from the Stored Passwords app (Control Panel/User Accounts/Manage my network passwords).