Return
-
Title
The locked out reason does not show anything -
Description
Locked out accounts do not show any reason, or the data may be sporadic. -
Cause
The "Locked out reason" shows audited events from DCs that are collected by Active Administrator agents.
The locked out accounts are pulled live, and then correlated to the collected events.If there is nothing, the likely culprit is that the DC in which the lockout occurred does not have an agent installed, or it is malfunctioning.
Another reason could be that the DC is not auditing these events, but that is much less likely. -
Resolution
Go to Auditing and Alerting > Agents and make sure that every DC that this might be getting locked out on has an agent installed.
Make sure that the last collected alert time is recent as well, these events are pulled every 5 minutes or when the service restarts.