We have over 50 domain controllers in our Active Directory domain. Occasionally, we get calls from users reporting account lockouts that are happening several times a day. This problem occurs 99% of the time after a user has logged onto a computer, changed his password, and then forgotten to log off.
To find the computer that's causing the lockouts, we use Microsoft's free utility, EventComb, to search the security logs with the user's ID; it returns all the security events associated with that ID. This saves many hours of manually searching the security logs.