I have several account lockout issues in AD and I have traced the lockout and its coming from our Exchange HUBCAS server.
How I trace the lockout:
1. I used the Account lockout status tool to check which server it is getting bad password.
2. In DC server I check the security logs and found a 4771 event ID. In the Network Information of the log, The Client Addess is pointing in our Exchange HUBCAS server.
---------
Now from this, I tried to check the security log of this HUBCAS but I cannot find any related information pointing to that account. In exchange side, are there other logs I can check to validate this lockout account?