I had recently changed the administrator account at one of our IT consulting customer's sites, and I kept having the account lock out. Usually this can happen if there are disconnected RDP sessions or services that explicitly run with the administrator’s old credentials. It is not easy to tell where the lockouts are happening from, but I found some software that I was able to demo that displayed in real time when the account locked out and which computer caused it. There were about three disconnected sessions that kept causing the lockouts to happen due to disconnected RDP sessions. I would log off the disconnected session, and I would see another lockout from a different PC soon after. [more]
This software helped me know where to look, and might be useful for some of our customers that deal with user accounts on a regular basis. You can also unlock accounts through the console of this software.