find out which computer a user is locking an account
On a Windows Server 2008 and 2008 R2 domain controller the event ID is 4740. Once you have identified that machine locking your account you can check out the machine and see what's up. In many cases it is a machine you logged onto and lever logged off from.ote this is a successful action as the domain controller was able to successfully lock the account. The field information you want to know is: Target account name-the AD account name. Caller Machine Name-the machine name from where the account was locked out.