1.Filter Event ID 4740 which is the lockout event.
2.Filter Event view by the account name:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[EventData[Data[@Name='subjectUsername']='AccountName']]</Select>
</Query>
</QueryList>
<Select Path="Security">*[EventData[Data[@Name='TargetUsername']='test']]</Select>
3.
As stated by the additional information between " **** ", if the source of the lockouts is a TMG server, this is most probably caused by a mobile device (iPhone, iPad, iPod, Android, Windows Phone, Surface) or Apple OS application using ActiveSync to connect to Exchange but having wrong credentials. It could also be an Outlook Web App session left opened on a computer or mobile device but with wrong credentials.
If the user is unable to find the guilty device,this is where you can still ask the Enterprise Team to look for the device type ID or external source IP address.
When the Caller Computer Name is a computer, you simply have to tell the user about it and have him verify there is no scheduled task, service, application, network mapped drive or Cached Credentials with the old password.
When the Caller Computer Name is blank, it was often seen that the wifi network was configured on a device having wrong/old credentials. Special applications testing opened ports on network computers could also cause this.
Reference:
User Account lockouts
There are two good ways to find out where failed logon attempts are coming fromwhen you have several domain controllers. Event forwarding,and Microsoft's Account Lockout Tools.
Pastedfrom <http://serverfault.com/questions/547739/how-to-find-the-cause-of-locked-user-account-in-windows-ad-domain>
To find all locked accountsin AD
Get-QADObject-Sizelimit 0 -IncludedProperties AccountIsLockedOut, lockoutTime | where{$_.AccountIsLockedOut -Like “True”} |ft SamAccountName,AccountIsLockedOut,lockoutTime, City, ParentContainerDN
Get-QADUser-Sizelimit 0 -IncludedProperties AccountIsLockedOut,
Time -searchroot‘OULocation’,'OULocation’,'OULocation’ -locked |ft SamAccountName,AccountIsLockedOut, lockoutTime, City, ParentContainerDN
Get-QADUser -searchRoot ’OULocation’| Select-Object Name, sAMAccountName, LastLogonTimeStamp, AccountIsDisabled,AccountIsExpired, AccountIsLockedOut | Sort-ObjectLastLogonTimeStamp | format-table -auto
Pastedfrom <http://msexchangeguru.com/2013/07/23/powershell-output-dots/>