Finding why a user is locked out in Active Directory

You can use PowerShell and Quest tools.

You can just query all the AD user objects like this:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"}

If you go this route, you could create ps1 files that are scheduled to run and you can export to these to a csv or even to a website - by using ConvertTo-Html then exporting it to a html file. For example:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Export-Csv c:\lockedoutusers.csv

or html:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | CovertTo-Html > c:\lockedoutusers.html

Or if you wanted you could just throw it up on a gridview for an interactive view:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Out-GridView

If your auditing policy is set to only log successful events, you will only get successful events. Change your auditing policy to log logon failures as well, then look at these Microsoft tools to help you troubleshoot the lockout issue.