Troubleshoot Tips – Account lockout look for 4740 event id under security of domain controller event logs.