NT4 Domain User lockout

I have an NT4 user who keeps getting locked out. We have the security on the NT4 domain set so that after 3 invalid passwords the account is locked and can only be unlocked by an admin.
We have determined that the user's PC is not the culprit by turning it off.
We can only imagine that somewhere on the domain someone or something is continuously trying to authenticate. There is about 10mins between the account being unlocked and it locking again.
Is there any way I could determine from where the account is being used, we assume it must be on a desktop PC somewhere.

[cmccullough]

Re: NT4 Domain User lockout

Two suggestions would be:

1. Double-click on the Computers object to display all computers in Hyena's right window. Select all of them, then right-click and choose View Logged On Users. This will give you the logged on users for all computers. This may take a while to run depending on the number of computers you have.

2. Go to File->Export->Services and run the Services export. This will give you a delimited text file of services across all computers. Open this file with Excel and search for this user account. This will help you determine if a service somewhere is using that account as it's startup account.