Account lockout

From: Sloup Michal (michal.sloup_at_cz.glaverbel.com)
Date: 04/22/04 

Date: Thu, 22 Apr 2004 05:25:16 -0700

We are runnig W2K Domain. One of our users suddenly gets
locked out (regularly). I used EventComb to search all our
DC (we have almost 60) for some events.

I'm able to find events 642 and 644. Also I can see events
675 (failure code 18) and 681 (error code 3221226036).

It means that I can find the moment when the account is
locked, but I need also to know why! So I need to find
some events 675 or 681 with code 24 or 3221225578.

Can anyone advice where to look or what to switch on,
etc...

Any hint is appreciated.

Michal