User locked out

Eddie · Guest

I have a user who has their account locked out several times a day. I think
they used their windows account for application that needed domain user
rights. the problem is this person is our cio and he wont let me delete and
recreate his account. i have looked through all of the services on each of
our servers and didn't see his account listed. what tool can i use to track
this down to see what is try to authenticate with his credidentials. Thanks