Windows 2008 R2 gpupdate locks the user account

I built a Windows 2008 R2 server last year, and ever since my elevated account locks 10-12 times a day. After much research and testing I found that the server is locking my account at each failed attempt to update Group Policy (about every 90 minutes). I found no information on the web indicating any one else has seen this, and I find it unbelievable myself.

Each time 3 System events are logged on the server:

Event ID 14: The password stored in Credential Manager is invalid.
This might be caused by the user changing the password from this
computer or a different computer. To resolve this error, open
Credential Manager in Control Panel, and reenter the password for the
credential contoso\me.

There are no entries in Credential Manager. This happens whether or not I disable the Credential Manager service, whether or not I am logged on, whether or not I log out and use a local admin account to delete my profile.

Event ID 40960: The Security System detected an authentication error
for the server cifs/ContosoDC.contoso.com. The failure code from
authentication protocol Kerberos was "The user account has been
automatically locked because too many invalid logon attempts or
password change attempts have been requested. (0xc0000234)".

–

Event ID 1058:

The processing of Group Policy failed. Windows attempted to read the
file
\contoso.com\SysVol\contoso.com\Policies{78719F0C-3091-4B5C-9BC3-6498F729531E}\gpt.ini
from a domain controller and was not successful. Group Policy settings
may not be applied until this event is resolved. This issue may be
transient and could be caused by one or more of the following: a)
Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain
controller has not replicated to the current domain controller). c)
The Distributed File System (DFS) client has been disabled.

I checked the items a-c, none seem to be the case.

I've tested this thoroughly by checking that the user account is not locked, running gpupdate on the server, and then re-checking the user account, which immediately locks. I've used lockout tools to reveal that all lockouts are originating from this particular server. The user account has no associated email address, and I've extensively researched the usual array of known lockout issues.

Any clues for me ? I'm getting ready to take down this production server and reset its computer object in AD, but I don't know that it will help.