Troubleshooting AD lockouts with Event viewer
You can easily see when a user has been locked out of AD using Event Viewer.
To do so open Event Viewer and expand Security, Filter the log for Event ID 4740.
Displayed will be all the locked out users with the time, username and device that the lockout has come from.
