I have a user who gets frequent account lockouts. Daily lockouts occur.its really frustrating.the only thing I have checked is, active rdp sessions. how else can i check which tool is sending the bad password.i have used altools, but it doesn't give me any info that i've not already seen in the eventlogs. please help!1 person got this answerI do too